CVE-2025-23113

Executive Summary

CVE-2025-23113 is a Cross-Site Request Forgery (CSRF) vulnerability in REDCap version 14.9.6. The flaw resides in the logout functionality, which lacks CSRF protections. An attacker can craft a malicious CSV file containing an HTML injection payload in the alert-title field. When a victim uploads this CSV file, they are redirected to a page displaying the uploaded data. If the victim clicks on the injected alert-title value, it triggers a logout request, terminating their session, or redirects them to a phishing website. The CVSS score is 3.4 (Low), but the combination of CSRF and HTML injection can be leveraged for session termination or phishing attacks.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a web application vulnerability in the REDCap PHP-based application.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
• Base Score: 3.4 (Low)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L)

The low score reflects the requirement for user interaction and the limited impact (session termination). However, the HTML injection component can be used for phishing, increasing the real-world risk.

Deep Dive & Mechanics

The vulnerability stems from two issues:

1. CSRF on Logout: The logout endpoint (action=myprojects&logout=1) does not require a CSRF token or any anti-CSRF mechanism. This allows an attacker to forge a logout request on behalf of a victim.
2. HTML Injection in CSV Upload: When a user uploads a CSV file containing alert configurations, the alert-title field is not sanitized. An attacker can inject HTML/JavaScript into this field. The uploaded data is displayed on a page, and if the victim clicks on the injected alert-title value, it can execute a logout request or redirect to a malicious site.

Attack Flow:

1. Attacker crafts a CSV file with a malicious alert-title containing an HTML anchor tag that points to action=myprojects&logout=1 or a phishing URL.
2. Attacker sends the CSV file to the victim (e.g., via email or file upload).
3. Victim uploads the CSV file to REDCap.
4. REDCap displays the uploaded data, including the malicious alert-title.
5. Victim clicks on the alert-title link.
6. The browser sends a GET request to action=myprojects&logout=1, terminating the session, or redirects to a phishing site.

Vulnerable vs. Patched Code

Vulnerable Code (REDCap 14.9.6): The logout functionality in Logout.php or similar file likely contains:

// No CSRF token check
if (isset($_GET['logout']) && $_GET['logout'] == 1) {
    session_destroy();
    header('Location: index.php');
    exit;
}

The CSV upload handler does not sanitize the alert-title field:

// No sanitization
$alert_title = $_POST['alert-title'];
// ... store and display $alert_title directly

Patched Code (Hypothetical):

// Add CSRF token validation
if (isset($_GET['logout']) && $_GET['logout'] == 1) {
    if (!isset($_GET['csrf_token']) || $_GET['csrf_token'] !== $_SESSION['csrf_token']) {
        die('CSRF validation failed');
    }
    session_destroy();
    header('Location: index.php');
    exit;
}

// Sanitize alert-title
$alert_title = htmlspecialchars($_POST['alert-title'], ENT_QUOTES, 'UTF-8');

Exploitation & Lab Setup

Red Team

Prerequisites:

• REDCap 14.9.6 instance
• Victim user with upload permissions

Exploit Steps:

1. Create a malicious CSV file with the following content:

alert-title,other_field
<a href="https://redcap.example.com/redcap_v14.9.6/Logout.php?logout=1">Click here to view alert</a>,value1

2. Send the CSV file to the victim (e.g., via email).
3. Victim uploads the CSV file to REDCap.
4. Victim clicks on the "Click here to view alert" link.
5. The session is terminated.

Alternative Payload (Phishing):

alert-title,other_field
<a href="https://phishing.example.com">Click here to view alert</a>,value1

Blue Team

Detection:

• Monitor for CSV file uploads containing HTML tags in the alert-title field.
• Monitor for rapid logout requests (multiple logout=1 GET requests in a short time).
• Monitor for unusual referrer headers in logout requests.

Prevention:

• Implement CSRF tokens on all state-changing endpoints, including logout.
• Sanitize all user input, especially in CSV uploads.
• Use Content Security Policy (CSP) headers to prevent inline JavaScript execution.

Indicators of Compromise (IOCs)

• Network IOCs:
  • GET requests to /redcap_v*/Logout.php?logout=1 without a CSRF token.
  • CSV files containing HTML anchor tags in the alert-title field.
• File IOCs:
  • CSV files with alert-title containing <a href=...> or <script> tags.
• Behavioral IOCs:
  • Multiple logout events from the same user in a short period.
  • User session termination immediately after a CSV upload.

Detection Engineering

YARA Rule

rule CVE_2025_23113_CSV_HTML_Injection {
    meta:
        description = "Detects CSV files with HTML injection in alert-title field for CVE-2025-23113"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-23113"
    strings:
        $html_tag = /<[a-zA-Z\/].*?>/
        $alert_title = "alert-title"
    condition:
        $alert_title and #html_tag > 0
}

Sigma Rule

title: CVE-2025-23113 - CSRF Logout via CSV Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects logout requests without CSRF token after CSV upload
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: "logout=1"
    condition: selection
falsepositives:
    - Legitimate logout actions
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-23113 - CSRF Logout Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"logout=1"; http.uri; content:"redcap_v"; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable CSV upload functionality if not critical.
2. Implement CSRF tokens on the logout endpoint.
3. Sanitize all user input in CSV uploads, especially the alert-title field.

Long-term Fixes:

• Upgrade to a patched version of REDCap when available.
• Add CSRF protection to all state-changing endpoints.
• Implement input validation and output encoding for all user-supplied data.
• Use Content Security Policy (CSP) headers to mitigate HTML injection.

Workarounds:

• Restrict CSV upload permissions to trusted users only.
• Monitor logs for suspicious logout patterns.

Valters IT