CVE-2022-28108
Published: 19 April 2022
Summary
CVE-2022-28108 is a high-severity CSRF (CWE-352) vulnerability in Selenium Selenium Grid. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 4.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Selenium Server (Grid) versions prior to 4 are affected by a cross-site request forgery vulnerability tracked as CVE-2022-28108. The root cause is that the server accepts non-JSON content types including application/x-www-form-urlencoded, multipart/form-data, and text/plain, which bypasses intended CSRF protections that assume JSON-only requests. The issue carries a CVSS 3.1 base score of 8.8 and is classified under CWE-352.
An attacker can exploit the flaw by causing an authenticated user to submit crafted requests from a malicious web page. Because the server does not enforce same-origin or JSON-only checks, the attacker can trigger administrative actions or, when combined with DNS rebinding techniques, achieve remote code execution on the Grid node.
Public references, including the Selenium project downloads page and oss-security disclosures, direct users to upgrade to Selenium Server 4 or later, which enforces stricter content-type handling. The associated EPSS score rose from lower values to a peak of 0.8396 before receding to the current 0.2237, indicating a period of elevated exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-0276
Vulnerability details
Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.
Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.
Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.
Detects anomalous request patterns consistent with cross-site request forgery.