CVE-2023-38057

What it actually does

Improper input validation permits arbitrary JavaScript injection into free-text survey answers; the payload is stored and later executed in the browser context of any authenticated agent who views the reply, enabling cross-site scripting.

Why it matters to the business

Attackers can hijack agent sessions, exfiltrate customer data, or perform unauthorized actions inside the support platform, increasing risk of data leakage and operational disruption for organizations relying on the survey module.

How an attack unfolds

An attacker obtains a valid, unanswered survey link, submits a crafted JavaScript payload inside a free-text answer field, and waits for an authenticated agent to open the reply; the browser then executes the payload, allowing session theft or further actions on the agent's behalf.

How to fix it

Upgrade the OTRS Survey module to version 7.0.32 or newer for the 7.0 branch, 8.0.13 or newer for the 8.0 branch, and replace any Community Edition Survey module at 6.0.22 or earlier with a supported version that contains the fix.

How to confirm the fix worked

Confirm the installed Survey module version is outside the affected ranges (7.0.X < 7.0.32, 8.0.X < 8.0.13, CE 6.0.X <= 6.0.22), then test by submitting a benign script tag in a free-text field and verifying that it is escaped or blocked when the reply is rendered.

Typical attack path

1. Acquire a legitimate link to an unanswered survey request
2. Submit JavaScript payload in one or more free-text answer fields
3. Monitor or wait for an authenticated agent to read the survey reply
4. Execute delivered XSS payload to steal cookies, tokens, or perform actions as the agent

How to detect it

Inspect web server and application logs for survey answer submissions containing script tags, event handlers, or javascript: URIs; correlate any such submissions with subsequent agent access to the same survey reply records.

• <script
• javascript:
• onerror=
• onload=
• survey.*answer.*<.*script

What your security team should do

• Immediately upgrade all OTRS Survey installations to the fixed versions listed in remediation guidance
• Restrict survey link distribution to trusted recipients until patches are applied
• Enable web application firewall rules that block common XSS patterns in survey submissions
• Review agent session activity for any anomalous survey reply views after the vulnerability disclosure date