Reflected XSS in LimeSurvey Community Edition

Executive Summary

LimeSurvey Community Edition 7.0.14 has a reflected cross-site scripting (XSS) vulnerability on the administrative survey-participant CSV import result page. An attacker can create a malicious CSV file with embedded JavaScript in an invalid attribute column name. When a privileged user imports this file with 'Display attribute warnings' enabled, the script executes in their authenticated session.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual activity in administrative sessions after CSV imports. Check server logs for requests to the participant CSV import result page with unexpected parameters. Inspect imported CSV files for invalid attribute columns containing JavaScript payloads like attribute_<img src=x onerror=...>. Use network traffic analysis tools to detect unescaped HTML/JS in responses from the import page.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows an attacker to execute arbitrary JavaScript in the context of an authenticated administrative user. If the victim has superadmin permissions, the attacker could create a new superadministrator account, fully compromising the application. The attack requires social engineering to trick a privileged user into importing the malicious file.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. A successful exploit may expose sensitive survey data or administrative functions, compromising compliance with these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade LimeSurvey to version 7.1.2 or later. Disable the 'Display attribute warnings' feature if not required. Restrict tokens:import permission to trusted users only. Implement input validation for CSV files to block non-CSV content. Apply output encoding to all user-supplied data in administrative interfaces.

Useful 0 Not Useful 0