CVE-2024-56311

Executive Summary

CVE-2024-56311 is a Cross-Site Request Forgery (CSRF) vulnerability affecting REDCap versions up to 14.9.6. The flaw resides in the Notes section of calendar events, where an attacker can craft a malicious link or page that, when accessed by an authenticated user, triggers a logout request without the user's consent. This is possible because the logout functionality lacks CSRF protections, allowing an attacker to terminate a user's session. While the CVSS score is 0.0 (likely due to incomplete scoring), the impact is a denial of service (session termination) that can disrupt user workflows and potentially be chained with other attacks. The vulnerability is classified under CWE-352 (Cross-Site Request Forgery). No official patch has been released, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

REDCap is a web application typically deployed on-premises or in cloud environments. It is not distributed via package managers like NPM, PyPI, Go, or Ruby. Therefore, supply chain security concerns are minimal, but administrators should verify the integrity of their REDCap installation files and ensure they are obtained from official sources.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L)

Threat Level: Medium. The attack requires user interaction (clicking a link) and only results in session termination. However, it can be used to disrupt operations or as a precursor to other attacks (e.g., forcing re-authentication to capture credentials).

Deep Dive & Mechanics

The vulnerability exists because the logout endpoint in REDCap does not validate the origin of the request. An attacker can embed a request to the logout URL (e.g., https://redcap.example.com/logout.php) within a calendar event's Notes field. When a victim views the note, the browser automatically sends the request (e.g., via an image tag or JavaScript), terminating the session.

Root Cause: Missing CSRF token or origin header validation on the logout functionality.

Attack Flow:

1. Attacker creates a calendar event with a malicious note containing an HTML payload (e.g., <img src="https://redcap.example.com/logout.php" style="display:none">).
2. Victim, authenticated to REDCap, views the calendar event.
3. The browser sends a GET request to the logout endpoint.
4. The server processes the logout, destroying the session.
5. Victim is logged out and must re-authenticate.

Vulnerable vs. Patched Code

Vulnerable Code (REDCap <= 14.9.6): The logout endpoint likely does not check for a CSRF token or validate the Referer/Origin header.

// logout.php (simplified)
session_start();
session_destroy();
header('Location: index.php');
exit;

Patched Code (Hypothetical): A CSRF token should be generated and validated on the logout request.

// logout.php (patched)
session_start();
if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
    die('CSRF validation failed');
}
session_destroy();
header('Location: index.php');
exit;

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to REDCap with permission to create calendar events.
• Victim must be authenticated and view the malicious note.

Exploit Steps:

1. Log in to REDCap and navigate to a calendar event.
2. Edit the Notes field and inject the following payload:

   <img src="https://target-redcap.example.com/logout.php" style="display:none">
   

3. Save the event.
4. Send the victim a link to the calendar event (e.g., via email or messaging).
5. When the victim views the event, their session is terminated.

Alternative Payload (using JavaScript):

<script>
var xhr = new XMLHttpRequest();
xhr.open('GET', '/logout.php', true);
xhr.send();
</script>

Blue Team

Detection:

• Monitor for unusual logout patterns (e.g., multiple logouts in a short time).
• Check server logs for requests to logout.php with no prior POST data or CSRF token.
• Use the detection rules below.

Mitigation:

• Implement CSRF tokens on all state-changing endpoints, including logout.
• Validate the Origin or Referer header on logout requests.
• Consider using SameSite cookies (set to Lax or Strict).

Indicators of Compromise (IOCs)

• Network:
  • HTTP GET requests to /logout.php without a Referer header or with a Referer pointing to a calendar event page.
  • Unusual spike in logout events from a single user.
• Host:
  • Web server logs showing repeated logout.php requests from the same IP.
  • Calendar event notes containing HTML/JavaScript payloads.
• File:
  • No specific file IOCs; the attack is purely web-based.

Detection Engineering

YARA Rule

rule CVE_2024_56311_CSRF_Logout {
    meta:
        description = "Detects REDCap CSRF logout exploit payloads in calendar notes"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-56311"
    strings:
        $logout_url = "logout.php"
        $img_tag = /<img[^>]+src\s*=\s*["'][^"']*logout\.php["'][^>]*>/i
        $script_tag = /<script[^>]*>.*logout\.php.*<\/script>/i
    condition:
        any of ($img_tag, $script_tag) and $logout_url
}

Sigma Rule

title: REDCap CSRF Logout Exploit
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-56311 by injecting logout requests into calendar notes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: GET
        c-uri: '/logout.php'
        cs-referer: '*calendar*'
    condition: selection
falsepositives:
    - Legitimate logout from calendar page (rare)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-56311 REDCap CSRF Logout Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/logout.php"; http_uri;
    pcre:"/Referer:[^\r\n]*calendar/i";
    classtype:attempted-dos;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Implement CSRF Protection: Add a CSRF token to the logout form and validate it on the server side.
2. Validate Origin Headers: Check the Origin or Referer header on logout requests to ensure they originate from the same site.
3. Use SameSite Cookies: Set the session cookie to SameSite=Lax or Strict to prevent cross-site requests.

Long-Term Fix:

• Apply any official patch from REDCap when released.
• Conduct a security audit of all state-changing endpoints.

Workaround:

• Disable the ability to embed HTML in calendar notes (if possible) or sanitize user input to remove script and image tags.

Valters IT
Securing Digital Frontiers