LimeSurvey 6.13.0 Hit by Redirect Loop: A DoS Vulnerability Analysis (CVE-2025-41074)

Overview

CVE-2025-41074 describes a Denial of Service (DoS) vulnerability affecting LimeSurvey version 6.13.0. The vulnerability resides in the /optout endpoint. When accessed directly, this endpoint triggers an infinite HTTP redirect loop. This loop can quickly exhaust server and/or client resources, leading to service degradation or browser instability for users interacting with the affected LimeSurvey instance.

Technical Details

The root cause of the vulnerability lies in the flawed logic within the /optout endpoint. Instead of handling direct access gracefully (e.g., displaying a helpful message or redirecting to a valid page), the endpoint enters an uncontrolled redirect sequence. The system fails to detect or break this loop, causing it to continuously send HTTP 301 or 302 redirect responses. An attacker can exploit this by simply sending an HTTP request to the /optout endpoint, initiating the resource-intensive redirect loop.

Attackers could potentially leverage this vulnerability to impact the following:

• Server Resource Exhaustion: A sustained attack with multiple requests to the vulnerable endpoint could overwhelm the server’s CPU, memory, and network bandwidth.
• Client-Side Denial of Service: Users inadvertently accessing the /optout endpoint, or malicious actors tricking users into doing so, may experience browser freezes or crashes due to the excessive number of redirects.

CVSS Analysis

Due to the nature of the vulnerability the CVSS score has been determined as N/A.

The severity of this vulnerability is not yet rated but could be categorized as Medium, depending on the impact assessment of individual installations. Because of the nature of the vulnerability the CVSS score is not currently applicable.

Possible Impact

The exploitation of CVE-2025-41074 can lead to several negative consequences:

• Service Disruption: The LimeSurvey instance may become temporarily unavailable due to server overload.
• Reputational Damage: Users experiencing browser crashes or service unavailability may lose confidence in the platform.
• Resource Costs: Remediation efforts to restore service can incur costs in terms of time, effort, and potential hardware upgrades.

Mitigation or Patch Steps

Currently, there is no official patch available for LimeSurvey 6.13.0 to address this vulnerability. However, there are several mitigation strategies that can be implemented to reduce the risk:

• Implement Rate Limiting: Configure your web server (e.g., Apache, Nginx) to limit the number of requests to the /optout endpoint from a single IP address within a specific timeframe.
• Web Application Firewall (WAF) Rules: Deploy WAF rules to detect and block suspicious traffic patterns targeting the /optout endpoint, such as a high volume of requests or redirect loops.
• Monitor Server Resources: Closely monitor server resource utilization (CPU, memory, network) and set up alerts to detect any anomalies that might indicate a DoS attack.
• Contact LimeSurvey Support: Reach out to LimeSurvey support to inquire about a future patch or workaround for this vulnerability.
• Upgrade: Check for later versions of LimeSurvey which may have the bug fixed.

References

INCIBE-CERT Advisory – Multiple Vulnerabilities in LimeSurvey