CVE-2021-41608
📋 TL;DR
This vulnerability allows unauthenticated remote attackers to sequentially access survey user data by manipulating the ID parameter in the UploadedImageDisplay.aspx endpoint. It affects SelectSurvey.NET versions before 5.052.000, exposing sensitive survey submissions to unauthorized disclosure.
💻 Affected Systems
- SelectSurvey.NET
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete exposure of all survey submissions including sensitive personal information, intellectual property, or confidential data stored in the system.
Likely Case
Partial data breach where attackers harvest survey responses containing personal identifiable information, business data, or other sensitive content.
If Mitigated
Limited exposure with proper network segmentation and access controls preventing external exploitation attempts.
🎯 Exploit Status
Simple parameter manipulation attack requiring no authentication or special tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.052.000
Vendor Advisory: https://www.classapps.com/product_ssv5.aspx
Restart Required: Yes
Instructions:
1. Download SelectSurvey.NET version 5.052.000 or later from ClassApps website. 2. Backup current installation and database. 3. Install the updated version following vendor instructions. 4. Restart IIS/application services.
🔧 Temporary Workarounds
Block vulnerable endpoint
windowsRestrict access to UploadedImageDisplay.aspx endpoint using web server rules or WAF
# IIS URL Rewrite rule to block access
<rule name="BlockUploadedImageDisplay" stopProcessing="true">
<match url="UploadedImageDisplay\.aspx" />
<action type="CustomResponse" statusCode="403" statusReason="Forbidden" />
</rule>
Implement authentication requirement
windowsAdd authentication checks to the vulnerable endpoint
# In web.config add authorization requirement
<location path="UploadedImageDisplay.aspx">
<system.web>
<authorization>
<deny users="?" />
</authorization>
</system.web>
</location>
🧯 If You Can't Patch
- Implement network segmentation to restrict access to the survey application from untrusted networks
- Deploy a web application firewall (WAF) with rules to detect and block sequential ID parameter attacks
🔍 How to Verify
Check if Vulnerable:
Test if unauthenticated requests to /UploadedImageDisplay.aspx with sequential ID parameters (1,2,3...) return different survey dataCheck Version:
Check application version in web interface or examine SelectSurvey.NET installation directory for version informationVerify Fix Applied:
Verify that version is 5.052.000 or higher and that sequential ID parameter requests no longer return unauthorized data📡 Detection & Monitoring
Log Indicators:
- Multiple sequential requests to UploadedImageDisplay.aspx with incrementing ID parameters
- Unusual access patterns from single IP addresses to the vulnerable endpoint
Network Indicators:
- HTTP GET requests with ID parameter values following sequential patterns
- Traffic to UploadedImageDisplay.aspx endpoint from unauthorized sources
SIEM Query:
source="web_logs" AND uri="*UploadedImageDisplay.aspx*" AND (query="*ID=1*" OR query="*ID=2*" OR query="*ID=3*") | stats count by src_ip🔗 References
- https://www.classapps.com/product_ssv5.aspx
- https://www.optiv.com/insights/source-zero/blog/classapps-inc-selectsurveynet-v50-vulnerabilities-disclosure
- https://www.classapps.com/product_ssv5.aspx
- https://www.optiv.com/insights/source-zero/blog/classapps-inc-selectsurveynet-v50-vulnerabilities-disclosure
