CVE-2025-41074
📋 TL;DR
This vulnerability in LimeSurvey's /optout endpoint causes infinite HTTP redirects when accessed directly, creating a denial-of-service condition. Attackers can exploit this to exhaust server resources or crash client browsers, affecting all LimeSurvey 6.13.0 installations with the vulnerable endpoint exposed.
💻 Affected Systems
- LimeSurvey
📦 What is this software?
Limesurvey by Limesurvey
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to server resource exhaustion, potentially affecting all users of the LimeSurvey instance and causing browser crashes for clients.
Likely Case
Service degradation with increased server load and potential browser instability for users accessing the vulnerable endpoint.
If Mitigated
Minimal impact if endpoint is blocked or patched, though some performance degradation may occur during attack attempts.
🎯 Exploit Status
Exploitation requires only HTTP requests to the vulnerable endpoint, making it trivial to execute.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.13.1 or later
Vendor Advisory: https://www.limesurvey.org/security/
Restart Required: No
Instructions:
1. Backup your LimeSurvey installation and database. 2. Download the latest version from the official LimeSurvey website. 3. Replace the affected files with the patched version. 4. Clear any caches if applicable.
🔧 Temporary Workarounds
Block /optout endpoint
allUse web server configuration to block access to the vulnerable /optout endpoint
# For Apache: RewriteRule ^/optout - [F]
# For Nginx: location ~ ^/optout { return 403; }
🧯 If You Can't Patch
- Implement rate limiting on the /optout endpoint to prevent DoS amplification
- Use a WAF to detect and block infinite redirect patterns
🔍 How to Verify
Check if Vulnerable:
Access https://your-limesurvey-instance/optout directly and check if it causes infinite redirects or returns an errorCheck Version:
Check the version.php file or admin dashboard for LimeSurvey versionVerify Fix Applied:
After patching, access the /optout endpoint and verify it no longer causes redirect loops📡 Detection & Monitoring
Log Indicators:
- High frequency of 3xx redirect responses from /optout endpoint
- Increased server load without corresponding legitimate traffic
Network Indicators:
- Excessive HTTP redirect chains originating from single IP addresses
- Unusual traffic patterns to /optout endpoint
SIEM Query:
source="web_server" (url="/optout" AND status_code=3*) | stats count by src_ip