CVE-2022-43694

An attacker can craft a malicious URL containing un-sanitized input that targets the Image Manipulation Library API endpoint. When a victim with access to the Concrete CMS dashboard clicks or is redirected to this URL, the injected script executes in the context of the victim's session. The attack is reflected (non-persistent) and requires the victim to be authenticated to the Concrete CMS instance. The advisory credits Bogdan and Adrian Tiron from FORTBRIDGE for reporting this issue [patch_id=1641219].

The patch does not show the specific vulnerable file or function. The advisory states that the vulnerability exists in an API endpoint used by the Image Manipulation Library in Concrete CMS versions below 8.5.10 and between 9.0.0 and 9.1.2.

The patch entry in the changelog states that output in the affected API endpoint was sanitized to prevent reflected XSS [patch_id=1641219]. The specific code diff is not included in the provided bundle, so the exact sanitization mechanism (e.g., HTML entity encoding, escaping) is not visible. The fix ensures that any user-controllable data echoed back by the Image Manipulation Library API is properly escaped before being sent to the browser, preventing script injection.