{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/limesurvey/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-63107"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LimeSurvey through 6.17.10","LimeSurvey through 7.0.4"],"_cs_severities":["high"],"_cs_tags":["ssrf","web-application","vulnerability","credential-access","data-exfiltration"],"_cs_type":"advisory","_cs_vendors":["LimeSurvey"],"content_html":"\u003cp\u003eCVE-2026-63107 identifies a server-side request forgery (SSRF) vulnerability affecting LimeSurvey versions up to 6.17.10 and 7.0.4. This critical flaw resides within the REST API survey template endpoint, specifically due to the unsanitized use of the HTTP Host header in the \u003ccode\u003egetTemplateData()\u003c/code\u003e function. An authenticated attacker can exploit this vulnerability by supplying a specially crafted \u003ccode\u003eHost\u003c/code\u003e header within their request. This manipulation forces the LimeSurvey server to initiate arbitrary HTTP requests to targets specified by the attacker, effectively bypassing network segmentation. The primary risk involves unauthorized access to internal network services, querying cloud metadata endpoints (such as those used by AWS, Azure, or GCP), and consequently, the potential extraction of highly sensitive credentials like Identity and Access Management (IAM) tokens, leading to broader cloud resource compromise. This vulnerability is significant for organizations using affected LimeSurvey instances, especially those deployed in cloud environments or with access to sensitive internal networks.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access\u003c/strong\u003e: The attacker gains authenticated access to a vulnerable LimeSurvey instance, either through compromised credentials, session hijacking, or by having a legitimate user account.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eVulnerability Identification\u003c/strong\u003e: The attacker identifies the vulnerable REST API survey template endpoint within the LimeSurvey application, knowing the \u003ccode\u003egetTemplateData()\u003c/code\u003e function processes the \u003ccode\u003eHost\u003c/code\u003e header unsanitized.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCraft Malicious Request\u003c/strong\u003e: The attacker crafts an HTTP request targeting the identified REST API endpoint (e.g., \u003ccode\u003e/index.php/api/.../survey/template\u003c/code\u003e). This request is designed to trigger the \u003ccode\u003egetTemplateData()\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eManipulate Host Header\u003c/strong\u003e: Within the crafted HTTP request, the attacker modifies the standard \u003ccode\u003eHost\u003c/code\u003e header value to point to an internal network IP address (e.g., \u003ccode\u003e192.168.1.1\u003c/code\u003e), a specific internal service, or a cloud metadata service IP (e.g., \u003ccode\u003e169.254.169.254\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eServer-Side Request Forgery (SSRF)\u003c/strong\u003e: Upon receiving the attacker's request, the LimeSurvey server processes it. Due to the vulnerability, the \u003ccode\u003egetTemplateData()\u003c/code\u003e function misuses the manipulated \u003ccode\u003eHost\u003c/code\u003e header to construct and perform an \u003cem\u003eoutgoing\u003c/em\u003e HTTP request to the attacker-specified internal or cloud resource.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInternal Network and Cloud Metadata Access\u003c/strong\u003e: The server's outgoing request reaches the intended internal target. This could be an internal web application, a database, or a cloud instance metadata service.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eInformation Disclosure\u003c/strong\u003e: The internal resource responds to the server's request. The vulnerable LimeSurvey function may then inadvertently process and return this response data to the attacker through the legitimate API endpoint, revealing sensitive information such as internal network configurations, system details, or cloud IAM tokens.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCredential Exfiltration\u003c/strong\u003e: The attacker extracts the sensitive information, such as IAM tokens, from the server's response, enabling further lateral movement or privilege escalation within the cloud environment or internal network.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-63107 allows an authenticated attacker to perform server-side request forgery, gaining unauthorized access to internal network resources and cloud infrastructure. This can lead to sensitive data exposure, including the theft of critical cloud Identity and Access Management (IAM) tokens, which grant full control over cloud resources. For organizations hosting LimeSurvey in cloud environments, this poses a severe risk of cloud account compromise, data exfiltration from storage buckets, or unauthorized access to other cloud services. For on-premise deployments, attackers can map internal networks, access administrative interfaces, or pivot to other systems, circumventing network perimeter controls. The specific number of victims is not yet publicly reported, but all organizations using affected LimeSurvey versions are at risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-63107 immediately by upgrading LimeSurvey to a version beyond 6.17.10 or 7.0.4, as specified in the vendor advisory.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rule \u0026quot;Detect Possible LimeSurvey SSRF via Host Header Manipulation\u0026quot; to your SIEM to monitor for exploitation attempts of CVE-2026-63107.\u003c/li\u003e\n\u003cli\u003eEnable comprehensive web server logging for the LimeSurvey application, specifically capturing \u003ccode\u003ecs-method\u003c/code\u003e, \u003ccode\u003ecs-uri-stem\u003c/code\u003e, \u003ccode\u003ecs-host\u003c/code\u003e, \u003ccode\u003ecs-uri-query\u003c/code\u003e, and \u003ccode\u003esc-status\u003c/code\u003e fields, to aid in detecting and investigating suspicious requests.\u003c/li\u003e\n\u003cli\u003eImplement egress filtering on the network perimeter of your LimeSurvey server to restrict outbound connections to only necessary and approved destinations, thereby limiting the effectiveness of any SSRF attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-20T19:21:36Z","date_published":"2026-07-20T19:21:36Z","id":"https://feed.craftedsignal.io/briefs/2026-07-limesurvey-ssrf/","summary":"An authenticated attacker can exploit CVE-2026-63107, a server-side request forgery vulnerability in LimeSurvey versions through 6.17.10 and 7.0.4, by manipulating the HTTP Host header in the REST API survey template endpoint, allowing the server to issue arbitrary HTTP requests to internal networks and cloud metadata services, potentially leading to the extraction of sensitive credentials like IAM tokens.","title":"LimeSurvey Server-Side Request Forgery Vulnerability (CVE-2026-63107)","url":"https://feed.craftedsignal.io/briefs/2026-07-limesurvey-ssrf/"}],"language":"en","title":"CraftedSignal Threat Feed - LimeSurvey","version":"https://jsonfeed.org/version/1.1"}