A critical remote code execution vulnerability has been discovered in Lighthouse Studio, a prominent survey software product developed by Sawtooth Software.
Security researchers from Assetnote revealed the issue, which affects server-side Perl CGI scripts deployed across a wide range of hosting environments, often on Linux servers with Apache and mod_cgi.
The flaw (CVE-2025-34300) allows attackers to execute arbitrary system commands simply by manipulating specific survey parameters, posing a severe threat to the integrity of web servers hosting these surveys.
Critical Vulnerability Impacts Broad Install Base
Lighthouse Studio is widely used for designing, distributing, and collecting surveys, with its desktop application restricted to survey creators and a server-side CGI component responsible for survey presentation and data collection.
While the desktop application remains outside an attacker’s reach, the Perl CGI scripts underpinning the survey web interface are regularly exposed to the public internet.
Significantly, these scripts lack an automatic update mechanism and are often duplicated across numerous directories and survey instances on a single web server, amplifying the scale of risk.
The vulnerability arises from a poorly implemented templating mechanism within the obfuscated Perl source code.
Researchers reverse-engineered the relevant files, notably ciwweb.pl, which employs a naive placeholder system.
The templating logic parses any substring placed between [% and %] within HTML output and evaluates it as Perl code on the server, using the language’s built-in eval function.
Critically, certain input fields, such as the hid_Random_ACARAT query parameter, are incorporated into the output HTML and subject to this templating process, allowing user-controlled data to reach the eval sink.
Through tests on both contemporary and legacy versions of Lighthouse Studio, Assetnote found that mitigations in some releases such as auto-inserting spaces to prevent direct injection were either inconsistently applied or easily bypassed.
For example, passing the same query parameter multiple times as an array allowed attackers to evade input sanitation routines, since Perl’s s/// substitution operator ignores array references.
Reverse Engineering Exposes
A simple proof-of-concept exploit involves appending a parameter like hid_Random_ACARAT=[%60ls%60%], with URL-encoded backticks, to an HTTP request.
This payload results in execution of arbitrary system shell commands, for example, listing directory contents via ls.
The attack does not require authentication and is effective on the majority of Lighthouse Studio deployments in the wild, including both older 9.15.x and more recent 9.16.x versions.
In all tested configurations, the flaw was found to reliably expose web servers to full compromise.
Sawtooth Software was notified of the vulnerability on April 9, 2025, and responded by releasing version 9.16.14, which closes the eval injection vector and fortifies the templating logic.
Administrators are urged to update their deployments promptly, as the lack of an automated update process means many instances remain vulnerable by default.
According to the Report, The incident underscores the broader risks associated with legacy CGI scripts and obfuscated code, especially when templating or code evaluation logic is intermixed with user-controlled data.
With many enterprises hosting dozens to hundreds of Lighthouse Studio surveys and reusing scripts, the blast radius from exploitation could be substantial, including data theft and further lateral movement within affected organizations.
Security teams are advised to scan for instances of the CGI scripts, particularly references to ciwweb.pl and associated survey files, and to patch immediately in accordance with Sawtooth Software’s advisory.
Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant updates
