Security News > 2021 > May > Code Execution Flaw in Checkbox Survey Exploited in the Wild

A Checkbox Survey vulnerability that could allow a remote attacker to execute arbitrary code without authentication is being exploited in the wild, the CERT Coordination Center at Carnegie Mellon University warns.

A flexible online survey tool written in ASP.NET, Checkbox Survey helps organizations create professional surveys that can be easily accessed from either desktop computers or mobile devices.

The flaw found in Checkbox Survey, tracked as CVE-2021-27852, is related to insecure deserialization of view state data, a method employed by the ASP.NET page framework for preserving page and control values.

The Checkbox Survey code handles the data, but ignores the ASP.NET ViewState Message Authentication Code setting on the server, an issue that an attacker can exploit to create arbitrary data that, when deserialized, may lead to code execution.

"By making a specially-crafted request to a server that uses Checkbox Survey 6.x or earlier, a remote, unauthenticated attacker may be able to execute arbitrary code with the privileges of the web server," the advisory reads.

Checkbox has halted development of Checkbox Survey version 6.

News URL

http://feedproxy.google.com/~r/securityweek/~3/FsBXCb3O-qQ/code-execution-flaw-checkbox-survey-exploited-wild