CVE-2022-34128
Published: 16 April 2023
Summary
CVE-2022-34128 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Glpi-Project Positions. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 4.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The Cartography plugin, also known as positions, for GLPI contained an unrestricted file upload vulnerability in versions prior to 6.0.1. The flaw, tracked as CWE-434, resided in front/upload.php and permitted arbitrary PHP code supplied in POST data to be written to disk and subsequently executed, resulting in remote code execution with a CVSS 3.1 base score of 9.8.
Unauthenticated attackers with network access could send a crafted POST request containing malicious PHP payloads to the upload endpoint. Successful exploitation granted full control over the affected GLPI instance, allowing arbitrary command execution, data exfiltration, or further lateral movement within the environment.
The project’s GitHub security advisory GHSA-947x-g9g9-rcmx and the accompanying 6.0.1 release tag recommend immediate upgrade of the positions plugin to version 6.0.1 or later to close the upload vector.
EPSS for the CVE rose from lower values to a peak of 0.3266 before receding to the current 0.1889, indicating a measurable increase in observed exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-37144
Vulnerability details
The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.