CyberRota Analysis
AI-GeneratedLimeSurvey versions up to 6.17.10 and 7.0.4 are vulnerable due to a server-side request forgery (SSRF) flaw in the REST API survey template endpoint, allowing authenticated users to manipulate the Host header and trigger arbitrary HTTP requests. This vulnerability can lead to exposure of internal network services and sensitive credentials, including IAM tokens from cloud metadata services. Organizations using these versions should prioritize patching this vulnerability to mitigate the risk of unauthorized access and data leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
LimeSurvey through 6.17.10 and 7.0.4 contains a server-side request forgery vulnerability in the REST API survey template endpoint that allows authenticated users to cause the server to issue arbitrary HTTP requests by supplying a manipulated Host header. Attackers can exploit the unsanitized use of the HTTP Host header in the getTemplateData() function to reach internal network services, cloud metadata endpoints, and extract sensitive credentials such as IAM tokens from instance metadata services.