GLPI CVE-2022-35914 Detection Scenario by crowdsecurity | CrowdSec Hub

GLPI CVE-2022-35914

Attack scenariohttp:exploitMITRE T1595MITRE T1190cve.CVE-2022-35914

By: crowdsecurity
Version: 0.2
Name: crowdsecurity/CVE-2022-35914
Remediation: Ban

Detect CVE-2022-35914 exploits

Install with a top-level collection

16 collections include it

sudo cscli collections install crowdsecurity/whm

Installs 18 parsers and 66 scenarios, via HTTP - CVE Detection.

View WHM →

Installation

sudo cscli scenarios install crowdsecurity/CVE-2022-35914

Then reload CrowdSec: sudo systemctl reload crowdsec

Configuration

Hover a line or a note to see what each field does.

scenarios/crowdsecurity/CVE-2022-35914.yaml· 19 linesGitHub

1type: trigger1
2#debug: true
3name: crowdsecurity/CVE-2022-35914
4description: "Detect CVE-2022-35914 exploits"
5filter: "Upper(evt.Meta.http_path) contains Upper('/vendor/htmlawed/htmlawed/htmLawedTest.php')"2
6blackhole: 1m3
7groupby: "evt.Meta.source_ip"4
8labels:
9  type: exploit
10  remediation: true5
11  classification:6
12    - attack.T1595
13    - attack.T1190
14    - cve.CVE-2022-35914
15  spoofable: 0
16  confidence: 3
17  behavior: "http:exploit"
18  service: glpi
19  label: "GLPI CVE-2022-35914"

Installed on

Know where it runs

Sign in to see the Security Engines that run this attack scenario, the version they run and whether it was modified locally.

Documentation

CVE-2022-35914

Detects attempts of exploit of CVE-2022-35914 RCE vulnerability.

Reference: https://github.com/glpi-project/glpi/security/advisories/GHSA-c5gx-789q-5pcr