CVE-2022-50957: Drupal Avatar Uploader XSS Vulnerability

CVE-2022-50957 Overview

CVE-2022-50957 is a reflected cross-site scripting (XSS) vulnerability in the Drupal avatar_uploader module version 7.x-1.0-beta8. The flaw exists in avatar_uploader.pages.inc, where the file parameter is reflected into the response without proper output encoding. Unauthenticated attackers can craft URLs containing JavaScript payloads in the file parameter to execute arbitrary script in a victim's browser session. The weakness is classified under CWE-79: Improper Neutralization of Input During Web Page Generation. Exploitation requires user interaction, typically through a malicious link delivered via phishing or social engineering.

Critical Impact

Successful exploitation allows attackers to run arbitrary JavaScript in the browser context of authenticated Drupal users, enabling session theft, content manipulation, and targeted phishing against site administrators.

Affected Products

• Drupal avatar_uploader module version 7.x-1.0-beta8
• Drupal sites running the vulnerable module with the avatar upload pages exposed
• Any Drupal 7 deployment that has installed the affected contributed module

Discovery Timeline

• 2026-05-10 - CVE-2022-50957 published to the National Vulnerability Database
• 2026-05-13 - Last updated in NVD database

Technical Details for CVE-2022-50957

Vulnerability Analysis

The vulnerability resides in the avatar_uploader.pages.inc file of the Drupal avatar_uploader contributed module. The module accepts a file parameter through HTTP GET requests and reflects its value back into the rendered HTML response. Because the module fails to sanitize or HTML-encode this parameter before output, attacker-controlled markup is interpreted by the browser as live content.

An attacker constructs a URL containing a JavaScript payload in the file query parameter and delivers it to a victim. When the victim clicks the link, the payload renders inline within the page and executes in the origin of the vulnerable Drupal site. This grants the attacker the ability to read cookies that are not flagged HttpOnly, perform actions on behalf of the user, and pivot toward administrative compromise if the victim is a privileged account.

Root Cause

The root cause is missing output encoding on user-supplied input. The module does not pass the file parameter through Drupal's check_plain() or filter_xss() sanitization functions before embedding it in the HTML response. This violates standard secure coding guidance for [CWE-79].

Attack Vector

Exploitation is network-based and requires user interaction. The attacker delivers a crafted URL targeting the vulnerable endpoint with a script payload in the file parameter. No authentication is required to construct or send the malicious link. The victim's browser executes the reflected script in the context of the Drupal site. See the VulnCheck Advisory on Drupal XSS and Exploit-DB #50841 for the published proof-of-concept request format.

Detection Methods for CVE-2022-50957

Indicators of Compromise

• HTTP requests to paths handled by avatar_uploader.pages.inc containing <script>, javascript:, onerror=, or URL-encoded equivalents in the file parameter
• Web server access logs showing unusually long or encoded values in the file query string
• Referrer headers from external domains pointing users to avatar uploader URLs with suspicious query parameters

Detection Strategies

• Inspect Drupal web access logs for GET requests where the file parameter contains angle brackets, event handlers, or encoded script tokens such as %3Cscript%3E
• Deploy a web application firewall rule that flags reflected XSS patterns targeting the avatar_uploader URL path
• Run a vulnerability scan to identify Drupal installations with avatar_uploader version 7.x-1.0-beta8 present in the sites/all/modules directory

Monitoring Recommendations

• Alert on browser Content Security Policy (CSP) violation reports referencing the avatar uploader endpoints
• Monitor for outbound traffic from user sessions to attacker-controlled domains following visits to avatar uploader URLs
• Correlate authentication anomalies, such as session reuse from new IP addresses, with prior visits to the vulnerable module

How to Mitigate CVE-2022-50957

Immediate Actions Required

• Disable the avatar_uploader module on Drupal 7 sites until a patched release is verified
• Audit all installed Drupal contributed modules and remove avatar_uploader 7.x-1.0-beta8 if not actively required
• Apply a web application firewall rule blocking script and event-handler patterns in the file query parameter

Patch Information

No fixed version is identified in the published advisory. Site operators should monitor the Drupal Avatar Uploader Project page for an updated release and apply it once available. Until a patch is published, removal or disabling of the module is the recommended remediation path.

Workarounds

• Uninstall the avatar_uploader module and clear the Drupal cache to remove vulnerable routes
• Implement a strict Content Security Policy that disallows inline scripts to limit the impact of reflected payloads
• Add server-side input filtering at the reverse proxy or WAF layer to strip HTML metacharacters from the file parameter

# Example WAF rule (ModSecurity) to block reflected XSS on avatar_uploader
SecRule REQUEST_URI "@contains avatar_uploader" \
  "chain,id:1009571,phase:2,deny,status:403,msg:'CVE-2022-50957 XSS attempt'"
  SecRule ARGS:file "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:urlDecodeUni"