Full Report
REDCap, developed by Vanderbilt University, is a secure platform designed for data collection in research studies and operations.
Analysis Summary
# Vulnerability: Multiple Cross-Site Scripting (XSS) Vulnerabilities in REDCap
## CVE Details
- CVE ID: Not yet assigned (Applied for, pending assignment as of reporting)
- CVSS Score: Not explicitly stated (Severity implied as Medium/High based on XSS nature)
- CWE: Likely CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
## Affected Systems
- Products: REDCap (Developed by Vanderbilt University)
- Versions: Not explicitly listed, but implicitly all versions prior to the patched releases: versions prior to 15.0.27 LTS and 15.4.3 Standard.
- Configurations: Any standard installation used by application users.
## Vulnerability Description
The research identified multiple Stored Cross-Site Scripting (XSS) vulnerabilities within REDCap. These flaws allow an authenticated attacker to inject malicious JavaScript code into specific application fields. When other users interact with these fields (e.g., clicking a link generated by the payload), the script is executed in the victim's browser within the context of the REDCap session.
Affected locations identified include:
* REDCap Message
* Project Title
* Instrument Name
Although the REDCap session cookie has the `HttpOnly` attribute set, the successful execution of XSS payloads still poses risks to users and their data.
## Exploitation
- Status: Proof of Concept (PoC) available.
- Complexity: Low (Requires standard user authentication).
- Attack Vector: Adjacent (Requires an authenticated user to craft the payload and another user to view it).
**PoC Summary:** An authenticated user crafts a message containing an XSS payload (e.g., `<a href="javascript:alert('XSS')">Click Me</a>`) in the Messenger function or injects it into Project Title/Instrument Name fields. A victim user viewing the affected element executes the payload.
## Impact
- Confidentiality: High (Potential session hijacking, data exfiltration).
- Integrity: High (Ability to alter displayed data or functionality).
- Availability: Low/Medium (Could lead to denial of service for a specific user session).
## Remediation
### Patches
- REDCap **15.0.27 LTS** (Released June 12, 2025)
- REDCap **15.4.3 Standard** (Released June 12, 2025)
Trustwave strongly recommends immediate upgrade to the latest patched version.
### Workarounds
- No specific workarounds were detailed in the provided text beyond immediate patching.
## Detection
- **Indicators of Compromise (IoCs):** Observation of unusual script execution within the REDCap application interface, especially in messages or metadata fields.
- **Detection Methods and Tools:** Web Application Firewalls (WAF) capable of inspecting HTTP requests for common XSS payloads, manual security review of user-editable fields, and monitoring application logs for suspicious input across the affected areas (Messages, Project Title, Instrument Name).
## References
- Vendor advisory: Not explicitly linked in the provided text, but the information originated from Trustwave Responsible Disclosure.
- Relevant links:
- Trustwave News (Defanged): hxxps://www.trustwave.com/en-us/company/newsroom/news/levelblue-completes-acquisition-of-trustwave-to-form-the-worlds-largest-managed-security-services-provider/