CVE-2020-26712
📋 TL;DR
CVE-2020-26712 is a critical SQL injection vulnerability in REDCap's ToDoList function that allows attackers to execute arbitrary SQL commands via the sort parameter. This affects REDCap 10.3.4 installations where an attacker could potentially compromise all databases accessible to the application. Organizations using vulnerable REDCap versions for research data management are at risk.
💻 Affected Systems
- REDCap (Research Electronic Data Capture)
📦 What is this software?
Redcap by Vanderbilt
Redcap by Vanderbilt
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise including data theft, data manipulation, privilege escalation, and potential remote code execution on the database server.
Likely Case
Unauthorized access to sensitive research data, patient information, or study records stored in REDCap databases.
If Mitigated
Limited impact with proper input validation, parameterized queries, and database permission restrictions in place.
🎯 Exploit Status
SQL injection via sort parameter requires some level of access but is technically simple to exploit once identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 10.3.4 (10.3.5+)
Vendor Advisory: https://www.project-redcap.org/
Restart Required: No
Instructions:
1. Backup your REDCap installation and databases. 2. Download the latest REDCap version from the official website. 3. Follow REDCap's upgrade documentation to apply the update. 4. Verify the ToDoList function no longer accepts raw SQL in sort parameter.
🔧 Temporary Workarounds
Disable ToDoList Function
allTemporarily disable or restrict access to the vulnerable ToDoList function
# Modify REDCap configuration or access controls to disable ToDoList module
Web Application Firewall Rules
allImplement WAF rules to block SQL injection patterns in sort parameters
# Example ModSecurity rule: SecRule ARGS:sort "@detectSQLi" "id:1001,phase:2,deny"
🧯 If You Can't Patch
- Implement strict input validation on all sort parameters to only allow expected values
- Apply principle of least privilege to database accounts used by REDCap
🔍 How to Verify
Check if Vulnerable:
Check REDCap version in Control Center > Configuration Check or examine version.php fileCheck Version:
grep 'REDCAP_VERSION' /path/to/redcap/version.phpVerify Fix Applied:
Test ToDoList function with SQL injection payloads in sort parameter; should be rejected or sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts followed by ToDoList access
- Sort parameters containing SQL keywords (UNION, SELECT, etc.)
Network Indicators:
- HTTP requests to ToDoList endpoint with suspicious sort parameters
- Unusual database traffic patterns from web server
SIEM Query:
source="web_logs" AND uri="/redcap/*/ToDoList*" AND query="*sort=*" AND (query="*UNION*" OR query="*SELECT*" OR query="*INSERT*")