LimeSurvey Reflected XSS via Import Warnings

Executive Summary

LimeSurvey has a reflected Cross-Site Scripting (XSS) vulnerability where attacker-controlled content from a crafted .lss survey file is not properly encoded when displaying import warnings. This allows malicious JavaScript to execute in the administrative interface when a privileged user imports the file.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual administrative actions or unexpected JavaScript execution in the LimeSurvey interface. Check for imported .lss files containing suspicious content like onerror handlers in image tags. Review server logs for failed import attempts or warnings related to survey imports.

Useful 0 Not Useful 0

Impact Analysis

If exploited, an attacker could execute arbitrary JavaScript in the context of a superadministrator's session. This could lead to account compromise, creation of persistent superadministrator accounts, and unauthorized access to sensitive data and configurations.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Compliance may be compromised if sensitive data is exposed or modified due to the XSS attack.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade LimeSurvey to version 7.1.2 or later to apply the patch that fixes the XSS vulnerability in import warnings.
• Restrict survey import permissions to trusted administrators only to reduce exposure to malicious .lss files.
• Implement content validation for uploaded .lss files to detect and block files containing executable scripts or unusual tags.
• Monitor administrative accounts for unauthorized changes or suspicious activities following survey imports.

Useful 0 Not Useful 0