CVE-2024-24506: LimeSurvey XSS Vulnerability

CVE-2024-24506 Overview

CVE-2024-24506 is a Cross-Site Scripting (XSS) vulnerability [CWE-79] affecting LimeSurvey Community Edition version 5.3.32+220817. The flaw resides in the General Settings function, specifically the Administrator email address parameter. An unauthenticated remote attacker can inject arbitrary script content that executes in the browser of a user who interacts with the crafted input. Successful exploitation results in a scope change, allowing attacker-controlled script execution against administrative users of the LimeSurvey application.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of authenticated LimeSurvey administrators, enabling session theft, credential harvesting, and unauthorized actions against the survey platform.

Affected Products

LimeSurvey Community Edition 5.3.32+220817
LimeSurvey deployments using the affected General Settings component
Web administration interface exposing the Administrator email address parameter

Discovery Timeline

2024-04-03 - CVE-2024-24506 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24506

Vulnerability Analysis

The vulnerability is a stored or reflected Cross-Site Scripting flaw in the LimeSurvey General Settings configuration page. The Administrator email address parameter does not properly sanitize or encode user-supplied input before rendering it in the administrative interface. When an attacker submits a crafted payload containing HTML or JavaScript, the input is stored or reflected in a way that the browser interprets as executable script.

The attack requires user interaction, meaning a victim must load the page containing the injected payload. Because the scope changes on successful exploitation, script execution occurs in the security context of the LimeSurvey administrative interface. This exposes session tokens, cookies, and any actions available to authenticated administrators.

Additional technical context is available in the LimeSurvey Bug Relationship Graph and the Exploit-DB entry #51926.

Root Cause

The root cause is insufficient input validation and output encoding on the Administrator email address parameter in the General Settings function. The application accepts arbitrary characters in the email field and renders them without escaping HTML control characters. This deviates from the expected email format validation and standard XSS prevention practices.

Attack Vector

The attack is delivered over the network with low complexity and no authentication required. An attacker submits a payload through the General Settings form, targeting the Administrator email address field. When an administrator subsequently views a page that renders this field, the injected script executes in their browser. Typical payloads include JavaScript designed to exfiltrate session cookies, perform CSRF actions, or redirect users to attacker-controlled infrastructure.

No verified proof-of-concept code is reproduced here. Refer to the Exploit-DB entry #51926 for the published technical details of the injection payload and the affected request parameters.

Detection Methods for CVE-2024-24506

Indicators of Compromise

Presence of HTML tags, <script> blocks, or JavaScript event handlers in the Administrator email configuration value stored in the LimeSurvey database
Unexpected outbound requests from administrator browsers to unknown external domains after loading LimeSurvey administrative pages
Web server logs showing POST requests to the General Settings endpoint containing encoded script payloads

Detection Strategies

Inspect the sitename and administrator contact configuration values in the LimeSurvey settings table for non-email content or HTML markup
Deploy web application firewall (WAF) rules to identify script tags and JavaScript event handlers submitted to LimeSurvey configuration endpoints
Review application access logs for anomalous administrator session activity following General Settings modifications

Monitoring Recommendations

Enable HTTP request logging on the LimeSurvey administration interface and forward events to a centralized log platform for correlation
Alert on modifications to LimeSurvey global settings, particularly changes to administrator contact fields
Monitor browser Content Security Policy (CSP) violation reports from administrator sessions accessing LimeSurvey

How to Mitigate CVE-2024-24506

Immediate Actions Required

Upgrade LimeSurvey Community Edition to a version released after 5.3.32+220817 that addresses the General Settings input validation issue
Audit the Administrator email address setting and remove any non-email content or HTML markup currently stored
Restrict access to the LimeSurvey administration interface to trusted networks or through a VPN

Patch Information

No vendor advisory URL is listed in the NVD record. Consult the LimeSurvey Bug Relationship Graph for tracker discussion and upgrade to the latest LimeSurvey Community Edition release that resolves bug ID 19364.

Workarounds

Implement a strict Content Security Policy (CSP) that disallows inline scripts on the LimeSurvey administrative interface
Place LimeSurvey behind a web application firewall configured to block XSS payloads in POST parameters targeting configuration endpoints
Limit administrative account privileges and enforce short session timeouts to reduce the window for exploitation

bash

# Example CSP header to mitigate reflected/stored XSS in LimeSurvey admin pages
Header always set Content-Security-Policy "default-src 'self'; \
  script-src 'self'; \
  object-src 'none'; \
  base-uri 'self'; \
  frame-ancestors 'self'"