CVE-2022-50937: Ametys CMS Persistent XSS Vulnerability

CVE-2022-50937 Overview

Ametys CMS v4.4.1 contains a persistent cross-site scripting (XSS) vulnerability in the link directory's input fields for external links. Attackers can inject malicious script code in link text and descriptions to execute persistent attacks that compromise user sessions and manipulate application modules. This stored XSS flaw allows attackers to maintain a malicious payload within the CMS that executes whenever a victim user views the affected content.

Critical Impact

Authenticated attackers can inject persistent malicious scripts into link directory fields, enabling session hijacking, credential theft, and manipulation of CMS modules affecting all users who view the compromised content.

Affected Products

• Ametys CMS v4.4.1
• Ametys CMS Link Directory Module
• Ametys Portal Platform (External Link Components)

Discovery Timeline

• 2026-01-13 - CVE CVE-2022-50937 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2022-50937

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The persistent nature of this XSS vulnerability makes it particularly dangerous as the malicious payload is stored server-side within the Ametys CMS database and delivered to every user who accesses the affected link directory content.

The vulnerability exists because the Ametys CMS fails to properly sanitize user-supplied input in the link directory module before storing it in the database and rendering it back to users. Specifically, the input fields for external links—including the link text and description fields—do not implement adequate output encoding or input validation, allowing JavaScript code to be embedded directly into the stored content.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and output encoding within the Ametys CMS link directory component. When users with appropriate permissions create or edit external links, the application stores the raw input without sanitizing potentially dangerous HTML or JavaScript elements. Subsequently, when this content is rendered to other users, the browser interprets and executes the embedded scripts as legitimate code.

The lack of Content Security Policy (CSP) headers or other defense-in-depth mechanisms further exacerbates this issue, allowing injected scripts to operate without restriction within the application context.

Attack Vector

The attack is network-based and requires an authenticated attacker with permissions to create or modify link directory entries. The exploitation process involves:

1. An authenticated attacker accesses the link directory management interface within Ametys CMS
2. The attacker crafts malicious JavaScript payloads embedded within the link text or description fields
3. Upon saving, the malicious content is stored persistently in the CMS database
4. When any user (including administrators) views the affected link directory page, the stored script executes in their browser context
5. The malicious script can then steal session cookies, perform actions on behalf of the victim, or redirect users to phishing pages

The vulnerability requires user interaction in that a victim must view the page containing the malicious link entry for the attack to succeed.

Detection Methods for CVE-2022-50937

Indicators of Compromise

• Unusual JavaScript code patterns in link directory database entries, such as <script> tags or event handlers like onerror and onload
• Unexpected outbound network connections from client browsers when viewing link directory pages
• Session token exfiltration attempts to external domains
• Anomalous modifications to link directory entries by users who typically don't manage this content

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS payloads in form submissions to the link directory module
• Enable Content Security Policy (CSP) violation reporting to identify script injection attempts
• Monitor database content for stored XSS patterns using regular expression-based scanning
• Review access logs for unusual patterns of link directory modifications followed by page views from other users

Monitoring Recommendations

• Configure browser-side CSP headers with report-uri directive to capture XSS execution attempts
• Implement real-time alerting for database writes containing potential script injection patterns
• Monitor user session behavior for signs of session hijacking following link directory page access
• Review audit logs for link directory CRUD operations performed by unusual accounts or at unexpected times

How to Mitigate CVE-2022-50937

Immediate Actions Required

• Audit existing link directory entries for any stored XSS payloads and sanitize affected records immediately
• Implement strict input validation on all link directory form fields, rejecting or encoding HTML/JavaScript content
• Deploy Content Security Policy headers to prevent inline script execution
• Restrict link directory editing permissions to trusted administrator accounts only
• Consider temporarily disabling the link directory feature until a vendor patch is applied

Patch Information

Organizations should monitor the Ametys Platform for official security updates. Additional technical details about this vulnerability are available in the VulnCheck Ametys XSS Advisory and Vulnerability Lab #2275. A proof-of-concept is documented in Exploit-DB #50692.

Workarounds

• Apply output encoding to all link directory fields at the template/view layer using HTML entity encoding
• Implement a Content Security Policy header with script-src 'self' to block inline script execution
• Use a web application firewall (WAF) with XSS detection rules as a compensating control
• Sanitize existing database entries using server-side HTML sanitization libraries before rendering

# Example Apache configuration to add CSP headers
# Add to httpd.conf or .htaccess for Ametys CMS
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; frame-ancestors 'self';"
Header set X-Content-Type-Options "nosniff"
Header set X-XSS-Protection "1; mode=block"