CVE-2024-56310

Executive Summary

CVE-2024-56310 identifies a Cross-Site Request Forgery (CSRF) vulnerability in REDCap versions up to 14.9.6. The flaw resides in the Project Dashboards name field, which lacks CSRF protections on the logout functionality. An attacker can craft a malicious Project Dashboards name containing a payload that, when clicked by an authenticated user, triggers a logout request without the user's consent. This results in session termination, causing a denial of service (availability impact) and potentially disrupting ongoing research workflows. The vulnerability has a CVSS score of 0.0 (incorrectly assigned) but based on the vector, the actual severity is low (3.1) due to the requirement for user interaction and the limited impact (availability only). No public exploit code or patch is available at this time.

Supply Chain & Package Security

REDCap is a web application typically deployed as a PHP/MySQL stack. This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct application-level CSRF flaw. Organizations should verify the integrity of their REDCap installation files and ensure no unauthorized modifications have been made to the logout handling code.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
• Base Score: 3.1 (Low)
• Attack Vector: Network (AV:N) – The attack is performed over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need to be authenticated.
• User Interaction: Required (UI:R) – The victim must click on the malicious Project Dashboards name.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data is exposed.
• Integrity Impact: None (I:N) – No data is modified.
• Availability Impact: Low (A:L) – The victim's session is terminated, causing a temporary denial of service.

Threat Level: Low. The attack requires social engineering to lure a user into clicking a crafted link. The impact is limited to session termination, which can be mitigated by re-authentication.

Deep Dive & Mechanics

The vulnerability is a classic CSRF (CWE-352) in the logout functionality of REDCap. The application does not implement anti-CSRF tokens (e.g., nonces) on the logout endpoint. An attacker can embed a malicious payload in the Project Dashboards name field, which is rendered as a clickable link. When the victim clicks on this link, it triggers a GET or POST request to the logout endpoint (e.g., /redcap/logout.php), terminating the session.

Attack Flow:

1. The attacker creates a new Project Dashboard in REDCap with a name containing a CSRF payload, such as:

   <img src="https://target.redcap.edu/redcap/logout.php" style="display:none" />
   

   Or a direct link:

   <a href="https://target.redcap.edu/redcap/logout.php">Click here</a>
   

2. The attacker shares the malicious dashboard link with an authenticated victim (e.g., via email or chat).
3. The victim, while logged into REDCap, clicks the link.
4. The browser sends a request to the logout endpoint without any CSRF token validation.
5. The server processes the logout request, invalidating the session.
6. The victim is logged out and must re-authenticate to continue working.

Root Cause: The absence of CSRF protections (e.g., synchronizer token pattern, double-submit cookie) on the logout functionality. The Project Dashboards name field is not sanitized or validated to prevent injection of malicious HTML/JavaScript that can trigger cross-origin requests.

Vulnerable vs. Patched Code

Vulnerable Code (REDCap <= 14.9.6): The logout endpoint (logout.php) likely contains a simple session destruction without CSRF token verification:

<?php
// logout.php (vulnerable)
session_start();
session_destroy();
header('Location: index.php');
exit;
?>

Patched Code (Hypothetical): A patched version would include CSRF token validation:

<?php
// logout.php (patched)
session_start();
if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die('CSRF token validation failed.');
}
session_destroy();
header('Location: index.php');
exit;
?>

Additionally, the Project Dashboards name field should be sanitized to prevent HTML injection:

// When rendering dashboard name
echo htmlspecialchars($dashboard_name, ENT_QUOTES, 'UTF-8');

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a REDCap instance (version <= 14.9.6) with permission to create Project Dashboards.
• A victim user who is authenticated and will click the malicious link.

Exploitation Steps:

1. Log in to REDCap as an attacker with dashboard creation privileges.
2. Create a new Project Dashboard with a name containing the CSRF payload:

   <a href="https://target.redcap.edu/redcap/logout.php">Click here for free data</a>
   

3. Share the dashboard link with the victim (e.g., via email or messaging).
4. When the victim clicks the link, their session is terminated.

Proof-of-Concept (PoC) Code:

<!-- Malicious dashboard name payload -->
<a href="https://target.redcap.edu/redcap/logout.php">Click here</a>

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual patterns in Project Dashboards names (e.g., HTML tags, external URLs).
• Log all logout requests and correlate with user activity (e.g., sudden logout after clicking a dashboard link).
• Use web application firewall (WAF) rules to block requests to logout endpoints without proper CSRF tokens.

Defense:

• Implement CSRF tokens on all state-changing endpoints, including logout.
• Sanitize user input in Project Dashboards names using htmlspecialchars() or equivalent.
• Enforce same-origin policy for logout requests (e.g., check Referer header).
• Educate users about phishing attacks involving malicious dashboard links.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /redcap/logout.php without a Referer header matching the application origin.
  • Repeated logout requests from a single user within a short time frame.
• Host IOCs:
  • Log entries showing session destruction without prior user action.
  • Project Dashboards names containing HTML tags (e.g., <a>, <img>, <script>).
• File IOCs:
  • Modified logout.php file (if attacker has write access).
  • Suspicious entries in the REDCap database redcap_projects table with HTML in the dashboard_name field.

Detection Engineering

YARA Rule

rule CVE_2024_56310_CSRF_Logout {
    meta:
        description = "Detects CSRF payload in REDCap Project Dashboards names"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-56310"
    strings:
        $logout_ref = /href\s*=\s*["'][^"']*logout\.php["']/i
        $img_tag = /<img[^>]+src\s*=\s*["'][^"']*logout\.php["']/i
        $form_action = /action\s*=\s*["'][^"']*logout\.php["']/i
    condition:
        any of them
}

Sigma Rule

title: REDCap CSRF Logout via Project Dashboards
id: 8f7e3d2a-1b5c-4e9f-8d0a-6c3b2a1e5f7d
status: experimental
description: Detects potential CSRF attack on REDCap logout via malicious dashboard name
author: Valters IT
date: 2025/04/10
logsource:
    category: web
    product: apache
    service: access_log
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: "/redcap/logout.php"
        cs-referer|contains: "/redcap/ProjectDashboards/"
    condition: selection
falsepositives:
    - Legitimate logout after viewing a dashboard
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-56310 REDCap CSRF Logout Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/redcap/logout.php"; http_uri;
    pcre:"/Referer:\s*[^\r\n]*\/redcap\/ProjectDashboards\//i";
    sid:1000001;
    rev:1;
    metadata: cve CVE-2024-56310;
)

Remediation & Mitigation

Immediate Actions:

1. Apply Input Sanitization: Ensure all user-supplied data in Project Dashboards names is sanitized using htmlspecialchars() or a similar function to prevent HTML injection.
2. Implement CSRF Tokens: Add anti-CSRF tokens to the logout endpoint. Validate the token on every logout request.
3. Update REDCap: Monitor the official REDCap repository for a security patch. If available, upgrade to the patched version immediately.

Long-Term Mitigations:

• Web Application Firewall (WAF): Deploy a WAF with rules to block requests to logout endpoints without proper CSRF tokens.
• Security Headers: Implement SameSite=Strict or SameSite=Lax cookies to prevent cross-origin requests.
• User Education: Train users to recognize phishing attempts and avoid clicking suspicious links in REDCap.
• Code Review: Conduct a security audit of all state-changing endpoints to ensure CSRF protections are in place.

Workaround (if patch is unavailable):

• Disable the ability to create Project Dashboards for non-admin users.
• Manually add CSRF token validation to logout.php (see patched code example).

Valters IT