CVE-2025-41376: 
NixOS vulnerability analysis and mitigation

CVE-2025-41376 is a CRLF Injection vulnerability in Limesurvey v2.65.1+170522 (and versions from 2.65.1 up to but not including 3.0.0) that allows a remote, unauthenticated attacker to inject arbitrary HTTP headers and conduct HTTP response splitting attacks. The vulnerability is exploitable via a crafted URL targeting the /index.php/survey/index/sid/<SID>/token/ endpoint with CRLF-encoded sequences (e.g., %0d%0a). It was published on August 1, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (Red Hat CVE, INCIBE).

The root cause is improper neutralization of CRLF sequences in user-supplied input (CWE-93), specifically within the token parameter of the survey index endpoint. When a user-controlled value containing %0d%0a (carriage return + line feed) is reflected in an HTTP response header without sanitization, an attacker can inject additional headers or split the HTTP response. The attack requires no authentication, no special privileges, and no user interaction, making it trivially exploitable from the network. The vulnerable endpoint pattern is /index.php/survey/index/sid/<SID>/token/fwyfw%0d%0aCookie:%20POC (Red Hat CVE, INCIBE).

Successful exploitation enables an attacker to inject arbitrary HTTP response headers, facilitating HTTP response splitting attacks that can lead to cross-site scripting (XSS), cache poisoning, session fixation, or phishing by manipulating what content is served to end users. The primary impact is on integrity (low, per CVSS), with no direct confidentiality or availability impact to the vulnerable system itself. However, chained with other techniques, response splitting can be leveraged to hijack user sessions or deliver malicious content to victims browsing the affected Limesurvey instance (Red Hat CVE).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been confirmed at this time. The EPSS score is approximately 0.03% (0.000300), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat CVE, INCIBE).

1. Reconnaissance: Identify publicly accessible Limesurvey instances running versions 2.65.1 through 2.x (before 3.0.0) using search engines or web scanners. Enumerate active survey IDs (SIDs) by browsing the application or using automated tools.
2. Craft malicious URL: Construct a URL targeting the vulnerable endpoint with a CRLF-encoded payload in the token parameter, e.g., https://target.example.com/index.php/survey/index/sid/<SID>/token/fwyfw%0d%0aSet-Cookie:%20malicious=value.
3. Inject HTTP headers: Send the crafted request to the server. If the application reflects the token value unsanitized in an HTTP response header, the injected CRLF sequences split the response, allowing the attacker to insert arbitrary headers (e.g., Set-Cookie, Location).
4. Achieve attack objective: Depending on the injected headers, the attacker can perform cache poisoning (by injecting a crafted response body), session fixation (by setting a known session cookie), or redirect victims to a phishing page via a Location header — typically by tricking a victim into clicking the crafted URL (Red Hat CVE, INCIBE).

• Network: HTTP requests to /index.php/survey/index/sid/<SID>/token/ containing URL-encoded CRLF sequences (%0d%0a, %0D%0A, \r\n) in the token parameter.
• Logs: Web server access logs showing requests with encoded newline characters in the URL path or query string, particularly targeting the survey token endpoint; unusual Set-Cookie or Location headers appearing in server responses not generated by the application.
• Application Logs: Limesurvey application logs recording malformed or unexpected token values containing carriage return/line feed characters.

Upgrade Limesurvey to version 3.0.0 or later, as the affected range is versions 2.65.1 through 2.x (before 3.0.0). As an interim workaround, implement a web application firewall (WAF) rule to block requests containing CRLF sequences (%0d%0a, %0D%0A) in URL parameters, particularly targeting the survey token endpoint. Additionally, restrict public access to survey endpoints where feasible and ensure input validation is enforced at the application layer (Red Hat CVE, INCIBE).

INCIBE (Spain's National Cybersecurity Institute) published an advisory covering multiple vulnerabilities in Limesurvey, including CVE-2025-41376, on their CERT alert platform. Red Hat has also tracked this CVE in their security advisory database. No significant researcher commentary, social media discussion, or broader media coverage has been identified for this vulnerability (INCIBE, Red Hat CVE).