GLPI and htmLawed Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2022-35914)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2022-35914) is a critical PHP code injection flaw located within the htmLawedTest.php script of the third-party 'htmLawed' library bundled with GLPI. The htmLawedTest.php file is a utility script intended for testing and development purposes but is inadvertently exposed in production environments. Because the script fails to properly sanitize and validate user-supplied inputs before passing them to dynamic PHP evaluation routines, remote attackers can leverage this behavior to execute arbitrary PHP code on the host system.

2. Exploitation Mechanics & Attack Scenario

An unauthenticated attacker can directly access the vulnerable script via the public URI path /vendor/htmlawed/htmlawed/htmLawedTest.php. By sending a crafted HTTP POST or GET request containing malicious payloads in parameters such as css or spec, the attacker forces the script to execute arbitrary PHP functions (e.g., exec, system, passthru). Since this vulnerability is listed in the CISA KEV catalog and has an extremely high EPSS score, automated scanning tools and threat actors are actively exploiting this flaw in the wild to deploy web shells and establish persistent access.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical), the impact of successful exploitation is severe. Attackers can execute commands with the privileges of the web server user (e.g., www-data), allowing them to read sensitive configuration files, access database credentials, exfiltrate IT asset data managed by GLPI, and perform lateral movement within the internal network. This poses an imminent threat of data breaches, ransomware deployment, and complete operational disruption.