CVE-2024-35050: SurveyKing Privilege Escalation Flaw

CVE-2024-35050 Overview

CVE-2024-35050 affects SurveyKing v1.3.1, an open-source survey and questionnaire platform. The vulnerability allows attackers to escalate privileges by re-using the session ID of a user account that was deleted by an administrator. When an admin removes a user, the application fails to invalidate the associated session, permitting continued authenticated access under the deleted identity. The flaw is categorized under [CWE-613] Insufficient Session Expiration and carries network-based exploitability with low attacker complexity.

Critical Impact
Attackers holding a captured or previously issued session token can regain authenticated access after account deletion, bypassing administrative revocation controls and undermining access management.

Affected Products

SurveyKing v1.3.1
CPE: cpe:2.3:a:surveyking:surveyking:1.3.1:*:*:*:*:*:*:*
Deployments exposing the SurveyKing web interface to untrusted networks

Discovery Timeline

2024-05-14 - CVE-2024-35050 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35050

Vulnerability Analysis

SurveyKing v1.3.1 issues session identifiers upon successful authentication and stores them server-side to authorize subsequent requests. When an administrator deletes a user account, the application removes the user record but does not terminate active sessions bound to that account. The stale session identifier remains valid and continues to authorize API and UI actions.

An attacker that previously captured, exported, or was legitimately issued a session ID can continue interacting with the application after the account is removed. Because the deleted user's authorization context may not be re-evaluated on each request, the attacker may retain or elevate privileges relative to the intended administrative action. See the GitHub Issue Discussion for community context.

Root Cause

The root cause is insufficient session expiration [CWE-613]. Session lifecycle management is decoupled from user account lifecycle. Account deletion does not trigger a server-side session invalidation routine, leaving session tokens active until their natural timeout.

Attack Vector

Exploitation requires the attacker to possess a valid session identifier issued to a since-deleted account. The attacker submits the session cookie or token in HTTP requests to the SurveyKing backend. The server accepts the token and authorizes requests without reconfirming that the underlying user still exists or retains privileges. No user interaction is required, and the vulnerability is exploitable over the network.

No verified public exploit code is available. Refer to the GitHub Issue Discussion for reproduction details.

Detection Methods for CVE-2024-35050

Indicators of Compromise

Authenticated HTTP requests to SurveyKing endpoints referencing user identifiers that no longer exist in the database.
Session tokens observed active past the timestamp of an administrative account-deletion event.
Application logs showing successful actions attributed to deleted user accounts.

Detection Strategies

Correlate account-deletion audit events with subsequent authenticated activity carrying the deleted user's session identifier.
Alert on any server-side session store entries whose associated user record has been removed.
Review reverse-proxy or WAF logs for repeated requests bearing the same session cookie across long time windows following an admin deletion action.

Monitoring Recommendations

Enable verbose authentication and session-lifecycle logging within SurveyKing and forward events to a centralized SIEM.
Track administrator user-deletion actions as high-value audit events and pivot on the affected user ID for a defined lookback window.
Monitor for privilege-sensitive operations performed by accounts flagged as deleted or disabled.

How to Mitigate CVE-2024-35050

Immediate Actions Required

Restrict network exposure of SurveyKing v1.3.1 instances to trusted networks or place them behind an authenticated reverse proxy.
Force logout of all active sessions after any administrative user-deletion action by clearing the server-side session store.
Rotate session-signing keys to invalidate all outstanding tokens where feasible.
Audit administrator activity for recent account deletions and review subsequent access by the affected identifiers.

Patch Information

No vendor patch or fixed version is referenced in the NVD entry at time of publication. Track the upstream SurveyKing repository issue for remediation guidance and coordinate with the maintainers before deploying updates.

Workarounds

Reduce the server-side session timeout to the minimum practical value to shorten the exploitation window.
Implement an application-layer filter that rejects requests whose session identifier maps to a non-existent user record.
Require re-authentication for privileged operations rather than relying solely on session presence.
Where operationally acceptable, restart the SurveyKing application after user deletions to flush in-memory session state.

bash

# Configuration example - refer to vendor documentation for supported settings
# Reduce session timeout in application configuration (illustrative)
server.servlet.session.timeout=15m