CVE-2026-63107: LimeSurvey SSRF Vulnerability

CVE-2026-63107 Overview

CVE-2026-63107 is a Server-Side Request Forgery (SSRF) vulnerability affecting LimeSurvey through versions 6.17.10 and 7.0.4. The flaw resides in the REST API survey template endpoint, where the getTemplateData() function consumes the HTTP Host header without sanitization. Authenticated attackers can manipulate the Host header to force the server into issuing arbitrary outbound HTTP requests. This enables access to internal network services and cloud metadata endpoints, including AWS Instance Metadata Service (IMDS) endpoints that expose Identity and Access Management (IAM) credentials. The issue is tracked under [CWE-918].

Critical Impact
Authenticated users can pivot from the LimeSurvey application to internal infrastructure and extract cloud IAM tokens from instance metadata services.

Affected Products

LimeSurvey versions through 6.17.10
LimeSurvey versions through 7.0.4
LimeSurvey REST API survey template endpoint

Discovery Timeline

2026-07-20 - CVE-2026-63107 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63107

Vulnerability Analysis

The vulnerability exists in LimeSurvey's REST API survey template handling logic. The getTemplateData() function reads the HTTP Host header from the incoming request and incorporates it into a server-side outbound request without validation or allow-list enforcement. This design permits an authenticated caller to redirect the server's own HTTP client to arbitrary destinations.

Because the request originates from the LimeSurvey server itself, it bypasses network segmentation and reaches resources that are otherwise unreachable from the internet. Attackers commonly target the cloud metadata address 169.254.169.254 to retrieve short-lived IAM credentials from instance metadata services. Retrieved tokens can then be used to interact with cloud APIs under the compromised instance's role. The vulnerability requires low privileges and network access but no user interaction.

Root Cause

The root cause is unsanitized use of an attacker-controlled HTTP header as a destination for a server-initiated request. LimeSurvey trusts the Host header value passed by the client and forwards it as the target of the template data fetch. No allow-list, DNS pinning, or metadata IP block is applied before the outbound request is issued.

Attack Vector

An authenticated user sends a crafted REST API request to the survey template endpoint with a Host header pointing to an internal or metadata address. The LimeSurvey backend calls getTemplateData(), which uses the supplied host to issue an outbound HTTP request. The response, including sensitive content such as IAM credentials or internal service data, can be observed by the attacker. See the VulnCheck SSRF Advisory and the GitHub LimeSurvey Documentation for detailed technical analysis.

Detection Methods for CVE-2026-63107

Indicators of Compromise

Outbound HTTP requests from the LimeSurvey server to 169.254.169.254 or other link-local addresses.
REST API requests to the survey template endpoint containing Host header values that do not match the application's configured hostname.
Unexpected outbound connections from LimeSurvey to private RFC1918 address ranges or cloud metadata endpoints.
Access log entries showing repeated REST API calls with varying Host header values from a single authenticated session.

Detection Strategies

Inspect web server access logs for REST API calls where the Host header deviates from the canonical application FQDN.
Correlate authenticated LimeSurvey sessions with outbound network flows from the application server to non-standard destinations.
Deploy egress network monitoring that flags any connection attempt to instance metadata service IPs from application workloads.

Monitoring Recommendations

Enable audit logging for the REST API survey template endpoint and forward events to a centralized SIEM for correlation.
Monitor cloud audit trails (AWS CloudTrail, Azure Activity Log, GCP Audit Logs) for API activity originating from the LimeSurvey instance role outside expected baselines.
Alert on any IMDSv1 token retrieval or STS GetCallerIdentity calls that follow anomalous LimeSurvey REST traffic.

How to Mitigate CVE-2026-63107

Immediate Actions Required

Upgrade LimeSurvey to a patched release beyond 6.17.10 and 7.0.4 as soon as the vendor publishes fixed builds.
Enforce IMDSv2 with hop-limit restrictions on cloud instances hosting LimeSurvey to block SSRF-based credential theft.
Restrict outbound network egress from the LimeSurvey server to only required destinations using host or network firewalls.
Rotate IAM credentials, API tokens, and secrets accessible from the LimeSurvey instance role if compromise is suspected.

Patch Information

Monitor the VulnCheck SSRF Advisory and the GitHub LimeSurvey Documentation for updates on fixed versions. Apply upgrades to all LimeSurvey installations exposed to authenticated users and validate the fix in a staging environment before production rollout.

Workarounds

Configure the upstream web server or reverse proxy to reject requests whose Host header does not match the application's canonical hostname.
Block outbound traffic from the LimeSurvey server to 169.254.169.254 and other cloud metadata addresses at the network layer.
Limit LimeSurvey REST API access to trusted user roles and reduce the authenticated attack surface where feasible.

bash

# Example nginx configuration to reject unexpected Host headers
server {
    listen 443 ssl;
    server_name survey.example.com;

    if ($host != "survey.example.com") {
        return 400;
    }

    # Block egress to metadata endpoints at the OS firewall level:
    # iptables -A OUTPUT -d 169.254.169.254 -j DROP
}