CVE-2024-45527

Executive Summary

CVE-2024-45527 is a medium-severity HTML injection vulnerability affecting REDCap version 14.7.0. The flaw resides in the project title field during the "New Project" action, allowing an authenticated attacker to inject arbitrary HTML. This can be leveraged to perform a logout Cross-Site Request Forgery (CSRF) via index.php?logout=1, or to insert a malicious link to an external phishing site. The vulnerability requires user interaction (clicking a crafted link) and low privileges, but can lead to session termination or credential theft through social engineering.

Supply Chain & Package Security

REDCap is a web application typically deployed as a PHP/MySQL stack. No NPM, PyPI, Go, or Ruby packages are directly involved. However, administrators should verify the integrity of their REDCap installation files and ensure no unauthorized modifications have been made to the project title handling code.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must click a crafted link)
• Scope: Changed (impact may extend beyond the vulnerable component)
• Confidentiality Impact: Low (potential phishing data theft)
• Integrity Impact: Low (HTML injection, link manipulation)
• Availability Impact: None

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction and low privileges. The primary risk is phishing and session disruption.

Deep Dive & Mechanics

The vulnerability exists in the project creation functionality of REDCap 14.7.0. When a user creates a new project, the project title is not properly sanitized before being stored and later rendered in the web interface. An attacker can inject arbitrary HTML, including <script> tags or <a> tags with malicious href attributes.

Attack Flow:

1. An authenticated attacker creates a new project with a malicious title, e.g., <a href="https://evil.com/phish">Click here</a>.
2. The attacker shares the project link with a victim (e.g., via email or internal messaging).
3. The victim, also authenticated to REDCap, clicks the link and views the project.
4. The injected HTML renders, potentially:
   • Automatically triggering a logout via <img src="index.php?logout=1"> (CSRF).
   • Displaying a phishing link that steals credentials when clicked.

Root Cause: Lack of output encoding or sanitization of the project title field when displayed in the UI. The application likely uses echo $project_title without htmlspecialchars() or equivalent.

Vulnerable vs. Patched Code

Vulnerable Code (REDCap 14.7.0):

// In project_view.php or similar
echo "<h2>" . $project_title . "</h2>";

Patched Code (Expected):

// Properly escape HTML output
echo "<h2>" . htmlspecialchars($project_title, ENT_QUOTES, 'UTF-8') . "</h2>";

The patch should also validate input on creation, rejecting or encoding HTML tags in the project title field.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A REDCap 14.7.0 instance (e.g., Docker container).
• An authenticated user account with project creation privileges.

Exploit Steps:

1. Log in to REDCap.
2. Navigate to "New Project" and set the title to:

   <a href="https://evil.com/phish">Important: Verify your account</a>
   

3. Save the project and copy its URL.
4. Send the URL to the victim (e.g., via email).
5. When the victim views the project, the malicious link appears. If clicked, they are redirected to the phishing site.

Alternative Payload (Logout CSRF):

<img src="index.php?logout=1" style="display:none;">

This will log the victim out without their knowledge.

Blue Team

Detection:

• Monitor for project titles containing HTML tags (e.g., <, >, href, src).
• Alert on unusual project creation activity from a single user.
• Review web server logs for index.php?logout=1 requests following project views.

Hunting:

• Query database for project titles matching regex: <[^>]+>.
• Check for projects created with titles that include external URLs.

Indicators of Compromise (IOCs)

• Network: HTTP requests to index.php?logout=1 from authenticated sessions.
• Host: Project titles in the REDCap database containing HTML tags.
• Logs: Web server logs showing GET /redcap/index.php?logout=1 with a valid session cookie.
• File: No specific file IOCs; the vulnerability is data-driven.

Detection Engineering

YARA Rule

rule CVE_2024_45527_REDCap_HTML_Injection {
    meta:
        description = "Detects HTML injection attempts in REDCap project titles"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-45527"
    strings:
        $html_tag = /<[a-zA-Z\/][^>]*>/
        $logout = "index.php?logout=1"
        $phishing = /href\s*=\s*["']https?:\/\/[^"']*["']/
    condition:
        any of them
}

Sigma Rule

title: REDCap HTML Injection via Project Title
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects HTML injection attempts in REDCap project titles (CVE-2024-45527)
author: Valters IT
logsource:
    category: application
    product: redcap
detection:
    selection:
        event: project_created
        title|contains:
            - '<'
            - '>'
            - 'href='
            - 'src='
    condition: selection
falsepositives:
    - Legitimate use of HTML in project titles (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-45527 REDCap HTML Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/redcap/index.php"; http_uri; content:"action=create"; http_client_body; pcre:"/<[^>]+>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade REDCap to the latest patched version (if available) or apply vendor-supplied hotfix.
2. Implement input validation on the project title field to reject HTML tags.
3. Add output encoding using htmlspecialchars() in all views displaying project titles.

Workarounds:

• Use a Web Application Firewall (WAF) to block requests containing HTML tags in the project title parameter.
• Restrict project creation privileges to trusted users only.
• Monitor logs for suspicious project titles.

Long-term:

• Conduct a code review of all user-input fields for similar injection flaws.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Train users to recognize phishing attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert