CVE-2024-37394
📋 TL;DR
This stored XSS vulnerability in REDCap allows authenticated users to inject malicious scripts into Project Dashboards via title and content fields. When other users view these dashboards, the scripts execute in their browser context. All REDCap instances running vulnerable versions are affected.
💻 Affected Systems
- REDCap
📦 What is this software?
Redcap by Vanderbilt
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal session cookies, perform actions as other users, redirect to malicious sites, or deploy ransomware payloads through the trusted REDCap interface.
Likely Case
Authenticated attackers could steal credentials, manipulate data, or perform limited account takeover against users who view their malicious dashboards.
If Mitigated
With proper input validation and output encoding, malicious scripts would be rendered harmless as plain text rather than executable code.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.2.1 or later
Vendor Advisory: https://www.evms.edu/research/resources_services/redcap/redcap_change_log/
Restart Required: Yes
Instructions:
1. Backup REDCap database and files. 2. Download REDCap 14.2.1 or later. 3. Follow REDCap upgrade instructions. 4. Restart web server. 5. Verify dashboard functionality.
🔧 Temporary Workarounds
Disable Project Dashboards
allTemporarily disable the Project Dashboards feature to prevent exploitation
Modify REDCap configuration to disable dashboard functionality
Implement WAF Rules
allAdd web application firewall rules to block XSS payloads in dashboard fields
Configure WAF to filter <script>, javascript:, and other XSS patterns
🧯 If You Can't Patch
- Implement strict input validation on dashboard title and content fields
- Apply output encoding to all user-controlled content displayed in dashboards
🔍 How to Verify
Check if Vulnerable:
Check if REDCap version is 13.1.9 or earlier and Project Dashboards feature is enabledCheck Version:
Check REDCap Control Center or database version tableVerify Fix Applied:
Verify REDCap version is 14.2.1 or later and test dashboard fields with XSS payloads📡 Detection & Monitoring
Log Indicators:
- Unusual dashboard creation/modification patterns
- Long or encoded strings in dashboard fields
- Multiple failed XSS attempts
Network Indicators:
- Unexpected external connections from REDCap dashboard pages
- Script tags in dashboard content requests
SIEM Query:
source="redcap_logs" AND (dashboard_title CONTAINS "<script>" OR dashboard_content CONTAINS "javascript:")🔗 References
- https://www.evms.edu/research/resources_services/redcap/redcap_change_log/
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/multiple-cross-site-scripting-xss-vulnerabilities-in-redcap-cve-2024-37394-cve-2024-37395-and-cve-2024-37396/
- https://www.trustwave.com/hubfs/Web/Library/Advisories_txt/TWSL2024-003_XSS_REDCap_1.txt
- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/multiple-cross-site-scripting-xss-vulnerabilities-in-redcap-cve-2024-37394-cve-2024-37395-and-cve-2024-37396/
