CVE-2022-34468

What it actually does

An iframe without script permissions can execute JavaScript when a user clicks a javascript: link, bypassing the intended sandbox.

Why it matters to the business

Attackers can run unauthorized code in the application, risking data exposure or unauthorized actions in environments using the affected software.

How an attack unfolds

An attacker crafts a page containing a restricted iframe with a javascript: link. When the victim clicks the link, the script executes despite the permission restriction, allowing code injection.

How to fix it

Upgrade glpi-project/glpi to a fixed commit such as 2b8f9aa54ae4a4ec07bde0c8db739a292b8ec09a or 5db9ca9f678989560bcc7b46d4a89c241f25af01.

How to confirm the fix worked

Verify the software version matches a fixed commit and test that javascript: links in restricted iframes no longer execute.

Typical attack path

1. Attacker hosts malicious page with crafted iframe
2. Victim is lured to click javascript: link inside the iframe
3. Script executes in the context of the application
4. Attacker performs actions such as stealing data or hijacking the session

How to detect it

Inspect web logs and browser activity for unexpected javascript: URI executions or script behavior originating from restricted iframes.

What your security team should do

• Apply the listed fixed commits immediately
• Review and restrict iframe usage in web interfaces
• Monitor for unexpected script execution in user sessions