Impact

There is a potential for a cross-site scripting attack in the survey_accounts module if a user provides an invalid visit label.

While the data is properly JSON encoded, the Content-Type header is not set causing the web browser to interpret the payload as HTML, opening the possibility of a cross-site scripting if a user is tricked into following an invalid link.

Patches

--- a/modules/survey_accounts/ajax/ValidateEmailSubmitInput.php
+++ b/modules/survey_accounts/ajax/ValidateEmailSubmitInput.php
@@ -18,6 +18,7 @@ if (!$user->hasPermission('survey_accounts_view')) {
     header("HTTP/1.1 403 Forbidden");
     exit(0);
 }
+header("Content-Type: application/json; charset=utf-8");
 
 set_include_path(get_include_path().":../project/libraries:../php/libraries:");

Workarounds

LORIS projects not using the survey_accounts module can disable the module.