Password Reset Link Spoofing in LimeSurvey

Executive Summary

This vulnerability in LimeSurvey involves the construction of password reset links using the client-supplied HTTP Host header without proper validation. Because the default configuration does not define an allowedHosts allowlist, the host validation function does not operate effectively.

An unauthenticated remote attacker can submit a forgotten-password request for a known account with a spoofed Host header. This causes LimeSurvey to send a password reset email containing a reset link with a hostname controlled by the attacker but embedding a genuine validation key.

When the victim or an automated mail-security scanner accesses this link, the valid reset token is exposed to the attacker. The attacker can then use this token to reset the password and take over the victim's account.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a remote, unauthenticated attacker to hijack password reset tokens and take over user accounts in LimeSurvey.

By exploiting the flaw, the attacker can reset the password of a targeted account without authorization, gaining full access to that account.

This can lead to unauthorized access to sensitive survey data, manipulation of survey responses, or misuse of the compromised account for further attacks.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves monitoring for password reset requests that include suspicious or spoofed HTTP Host headers. Since the vulnerability arises from LimeSurvey constructing password reset links using the client-supplied Host header without validation, network or application logs can be inspected for unusual Host header values in password reset requests.

Commands to detect such activity could include searching web server logs for password reset requests with unexpected Host headers. For example, using grep on Apache or Nginx logs:

• grep -i 'password-reset' /var/log/apache2/access.log | grep -v 'your-legitimate-hostname'
• grep 'Host:' /var/log/nginx/access.log | grep -i 'password-reset' | grep -v 'your-legitimate-hostname'

Additionally, monitoring email logs for password reset emails containing unexpected hostnames in the reset links can help detect exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves configuring LimeSurvey to validate and restrict allowed Host headers used in password reset links. This can be done by defining an allowedHosts allowlist to constrain which hostnames are accepted.

According to the fix introduced, the system should have a persisted allowed-hosts configuration file that includes the legitimate server hostname. This file is auto-created on the first successful admin login and enforces host validation for all generated absolute URLs.

Other mitigation steps include:

• Ensure the allowed-hosts configuration file is properly set and maintained.
• Update LimeSurvey to a version that includes the patch for this vulnerability.
• Verify that password reset and email workflows fail safely if validated URLs cannot be generated.
• Monitor admin UI for warnings about missing allowed hosts and address them promptly.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability in LimeSurvey allows an attacker to hijack password reset tokens by exploiting an unvalidated HTTP Host header, leading to unauthorized account takeover.

Such unauthorized access to user accounts can result in exposure of personal data, which may violate data protection regulations like GDPR and HIPAA that require strict controls on access to personal and sensitive information.

Because LimeSurvey is used by organizations including those in healthcare and public sectors, this vulnerability could lead to non-compliance with these standards if exploited, due to failure to adequately protect user credentials and personal data.

The fix introduced a host allowlist validation system to prevent malicious Host headers, which helps mitigate the risk and supports compliance by ensuring password reset links are securely generated and sent only with trusted hostnames.

Useful 0 Not Useful 0