CVE-2025-41376: LimeSurvey CRLF Injection Vulnerability

CVE-2025-41376 Overview

CVE-2025-41376 is a Carriage Return Line Feed (CRLF) injection vulnerability affecting Limesurvey v2.65.1+170522. The flaw resides in the survey token handling within the /index.php/survey/index/sid/<SID>/token/ endpoint. A remote attacker can inject arbitrary HTTP headers by supplying encoded CRLF sequences (%0d%0a) in the token parameter. This enables HTTP response splitting attacks, which can lead to cache poisoning, session fixation, and cross-site scripting against survey participants. The vulnerability is tracked under CWE-93: Improper Neutralization of CRLF Sequences.

Critical Impact
Remote attackers can manipulate HTTP responses served to Limesurvey users, enabling header injection, cookie manipulation, and downstream client-side attacks without authentication.

Affected Products

Limesurvey v2.65.1+170522
Earlier Limesurvey v2 branch releases sharing the vulnerable survey token handler
Deployments exposing /index.php/survey/index/sid/<SID>/token/ to untrusted networks

Discovery Timeline

2025-08-01 - CVE-2025-41376 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-41376

Vulnerability Analysis

The vulnerability stems from insufficient sanitization of the token path parameter in Limesurvey's survey controller. When the application processes the token value, it fails to strip or reject CRLF characters (\r\n) before reflecting the value into HTTP response headers. An attacker crafts a URL such as /index.php/survey/index/sid/<SID>/token/fwyfw%0d%0aCookie:%20POC, causing the server to emit an attacker-controlled Cookie header alongside the legitimate response. This behavior enables HTTP response splitting, where the injected sequence terminates the intended header and introduces new headers or a second response body. User interaction is required, since victims must visit the attacker-supplied link, but no authentication or elevated privileges are needed.

Root Cause

The root cause is improper neutralization of CRLF sequences [CWE-93] in the token routing logic. Limesurvey's URL parser passes the raw token value into a response header context without filtering %0d and %0a byte sequences. Any character that decodes to \r or \n breaks header boundaries because HTTP uses CRLF as its structural delimiter.

Attack Vector

Exploitation is network-based and unauthenticated. The attacker builds a malicious survey URL containing URL-encoded CRLF bytes followed by attacker-chosen header content. When a victim loads the link, the Limesurvey server emits a split response, allowing header injection, forced cookie assignment, or cache poisoning at intermediary proxies. The vulnerability affects response integrity rather than confidentiality or availability. See the INCIBE Security Notice for coordinated advisory details.

Detection Methods for CVE-2025-41376

Indicators of Compromise

Web server access logs containing %0d%0a, %0D%0A, or raw CRLF characters within /index.php/survey/index/sid/*/token/* request paths
Unexpected Set-Cookie or duplicate header entries in Limesurvey response captures
Referrer chains showing users arriving at survey URLs from external phishing domains

Detection Strategies

Deploy web application firewall (WAF) rules that reject request URIs containing encoded or raw CRLF byte sequences targeting the survey token path
Enable HTTP response inspection to flag responses containing more than one status line or duplicated header blocks
Correlate outbound survey link click telemetry with URL patterns containing %0d%0a in the path segment

Monitoring Recommendations

Log all requests to /index.php/survey/index/ and alert on non-alphanumeric token values exceeding expected length
Monitor upstream caches and CDN nodes for cache key anomalies tied to survey endpoints
Review authentication and session logs for unexplained cookie assignments originating from Limesurvey responses

How to Mitigate CVE-2025-41376

Immediate Actions Required

Upgrade Limesurvey to a supported release beyond the v2.65.1+170522 branch; the v2 line is legacy and should be retired
Restrict external access to survey endpoints until sanitization controls are verified
Deploy WAF signatures that block CRLF byte sequences in request URIs

Patch Information

Refer to the INCIBE Security Notice for Limesurvey for coordinated vendor guidance. Organizations running v2.65.1+170522 should migrate to a current Limesurvey release that enforces strict input validation on the token parameter and rejects CRLF characters in URL path segments.

Workarounds

Add reverse proxy rules (nginx, Apache, HAProxy) that drop requests containing %0d, %0a, \r, or \n in the URL path
Enforce token format validation at the reverse proxy layer, permitting only alphanumeric characters of expected token length
Disable open survey access and require authenticated participant lists where feasible

bash

# Example nginx rule to block CRLF injection attempts on Limesurvey token paths
location ~* ^/index\.php/survey/index/sid/[0-9]+/token/ {
    if ($request_uri ~* "(%0d|%0a|%0D|%0A|\r|\n)") {
        return 400;
    }
    proxy_pass http://limesurvey_backend;
}