Listen to this Post
A Silent Threat Beneath Surveys: Major Flaw Hits Popular Software
A serious and silently pervasive security hole has been discovered in Lighthouse Studio, a widely used platform for building and distributing surveys, developed by Sawtooth Software. This vulnerability, now tracked as CVE-2025-34300, enables unauthenticated remote code execution (RCE) on web servers running the software. The flaw affects a large number of survey platforms deployed by universities, corporations, research firms, and marketing agencies worldwide. It stems from how the platform uses Perl CGI scripts, exposing backend systems to complete compromise via a maliciously crafted URL. What makes the threat even more dangerous is the software’s lack of automatic updates, leaving countless installations unpatched and vulnerable by default. Assetnote, the cybersecurity firm that disclosed the flaw, issued a dire warning about the extent of exposure and the ease of exploitation, urging administrators to act swiftly.
Lighthouse Studio Vulnerability Summary: How It Works and Why It’s Critical
The vulnerability at the heart of CVE-2025-34300 affects the server-side CGI scripts in Lighthouse Studio, specifically written in Perl and used to present and collect surveys over the web. Unlike the desktop application (which remains safe), these CGI scripts are exposed to the internet and commonly found running on Linux servers with Apache and mod_cgi. At the root of the issue is a templating mechanism implemented using the insecure use of Perl’s eval function, a common red flag in secure coding practices.
A parameter such as hid_Random_ACARAT can be injected with crafted content — for example, [%60ls%60%] — that is interpreted and executed as Perl code on the server. This templating syntax ([% ... %]) is designed to dynamically evaluate placeholders, but when user input is allowed into this system without strict sanitation, it becomes an open door for arbitrary command execution.
The Assetnote team reverse-engineered the software and demonstrated how even previous mitigation attempts (such as whitespace insertion to break the payloads) were bypassable. For instance, sending the same query parameter multiple times as an array let attackers sneak past filters, thanks to how Perl’s substitution operator ignores array references. As a result, attackers can run any shell command — like listing directories or pulling sensitive data — without logging in.
The flaw impacts both older and newer releases: Lighthouse Studio 9.15.x and 9.16.x versions are vulnerable. Proof-of-concept (PoC) exploits work reliably across these versions, highlighting a systemic and long-standing vulnerability in the software’s design.
Following the disclosure, Sawtooth Software responded on April 9, 2025, with the release of version 9.16.14, which addresses the flaw by hardening the templating logic and removing the eval-based processing.
However, the fact that the software lacks an automatic update mechanism means many installations will remain exposed unless manually patched. With some organizations hosting hundreds of surveys and duplicating CGI scripts across directories, the attack surface is alarmingly wide.
This incident is a stark reminder of the risks tied to outdated CGI scripts, especially those containing obfuscated code and unsafe templating logic. Security teams are strongly urged to scan for affected scripts — such as ciwweb.pl — and update their Lighthouse Studio installations immediately to prevent potential breaches and lateral movement across networks.
What Undercode Say: How Legacy Tech Can Open Doors to Full Server Compromise
Legacy Software, Modern Threats
The Lighthouse Studio flaw underscores a painful reality: legacy systems and scripting languages like Perl still power major parts of the web, and their security posture is often neglected. CGI scripts, while once common, are now considered outdated and risky due to their static nature and lack of sandboxing. This vulnerability stems from a deeply flawed design decision — allowing user-controlled input to be directly evaluated as code. That’s one of the cardinal sins in web security.
Eval Function: A Known Hazard
Using eval() on user input is widely recognized as a dangerous anti-pattern, particularly in languages like Perl or PHP. Developers sometimes lean on it for convenience, especially in templating, but the tradeoff is often catastrophic. In Lighthouse Studio, the use of eval within the HTML templating logic to interpret survey parameters essentially gives attackers remote access to the server’s shell — no credentials needed.
CGI Scripts with No Update Pipeline
What adds to the danger is the absence of an automatic update mechanism. This means each instance of the software must be manually updated, and in enterprise environments where Lighthouse Studio is often replicated across projects and departments, that’s unlikely to happen quickly. Each unpatched survey becomes an attack vector, especially since attackers don’t need to log in or know anything specific about the survey contents.
Real-World Impact: A Gateway to Broader Compromise
Because these surveys are typically hosted on internal or semi-public servers, a single successful exploit could grant an attacker deep lateral access. From running enumeration commands like ls or cat, they can pivot to accessing databases, sensitive user responses, or even installing persistent backdoors. Organizations often underestimate the sensitivity of survey data, but in research, healthcare, or employee feedback contexts, such information can be extremely valuable or damaging if leaked.
Scale of Exposure Is Vast
Thousands of companies use Lighthouse Studio, including marketing agencies, academic institutions, and global enterprises. It’s not uncommon for a single deployment to host hundreds of individual surveys. And since the vulnerable script (ciwweb.pl) is duplicated per survey or per folder, even one compromised survey can lead to systemic breach.
Patch Is Available — But Will It Be Applied?
While Sawtooth Software responded quickly with version 9.16.14, real-world patch adoption is slow when manual intervention is required. Admins may not even know about the flaw unless they follow cybersecurity news or actively monitor their systems for vulnerabilities. This makes CVE-2025-34300 a long-tail threat — it won’t fade overnight.
Lessons for the Industry
This case should be a wake-up call for software vendors and IT departments alike. Templating systems must never execute arbitrary code unless under strict sandboxing. There must be default update pipelines and warnings for vulnerable configurations. Legacy systems that still rely on Perl CGI must either be decommissioned or aggressively hardened.
Offensive Research Is Crucial
Assetnote’s role in uncovering this flaw highlights how responsible disclosure and offensive security research are vital. Many critical bugs aren’t found until someone takes the time to reverse-engineer obfuscated binaries and trace insecure logic. Without their work, this RCE could have remained unnoticed and silently exploited for years.
🔍 Fact Checker Results
✅ Exploit Confirmed: Researchers at Assetnote successfully demonstrated the RCE with proof-of-concept payloads.
✅ Patch Released: Sawtooth Software fixed the vulnerability in version 9.16.14.
❌ Auto Updates Missing: No automated patching mechanism exists, leaving many servers vulnerable by default.
📊 Prediction: Unpatched Systems Will Be Actively Exploited in the Wild
Attackers, especially those deploying automated scanning bots, will quickly identify and exploit vulnerable Lighthouse Studio instances still running outdated versions. Without a centralized patching system, organizations are at risk of data theft, system compromise, and lateral intrusions throughout their networks. This vulnerability will likely be weaponized in public exploit frameworks within weeks. Proactive scanning and patching will determine who avoids the fallout.
References:
Reported By: cyberpress.org
Extra Source Hub:
https://www.instagram.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
