Trustwave SpiderLabs Security Advisory TWSL2023-005: SQL Injection in Vanderbilt University RedCap Published: 07/21/23 Version: 1.0 Vendor: Vanderbilt University Product: RedCap Version affected: Prior to 12.0.26 LTS and prior to 12.3.2 Standard. Product description: REDCap is a web application for building and managing online surveys and databases. *********************************************************** Finding 1: SQL Injection Credit: Animesh Acharya of Trustwave CVE: CVE-2023-37361 CWE: CWE-89 The REDCap web application does not properly validate user supplied input, allowing application users to perform unauthorized execution of SQL queries on the application’s database, resulting in unauthorized access to the entire database exposing sensitive application data such as database names, users, password hashes and API tokens. PoC : ============================================ Prerequisites: * User must be an authenticated as an administrator of the RedCap application Affected Feature: * Creating a new project Vulnerable Parameters: * scheduling, repeatforms, purpose, app_title, randomization Procedure: 1. Authenticate as an administrator and navigate to the project creation feature using a web browser and a web interception proxy. 2. Populate the form within the “New Project” tab and click on “Create Project”. 3. Intercept the POST request and save the request to a TXT file named “request.txt”. 4. Modify any of the vulnerable parameters within the saved request to contain an asterisk (*). 5. Provide the “request.txt” to the ‘sqlmap’ sql injection testing tool using the following invocation parameters: ./sqlmap -r request.txt --curent-db 6. Observe the database name being disclosed. *********************************************************** Remediation Steps: Upgrade to either the most recent stable release of REDCap or, at the very least, version 12.0.26 LTS/12.3.2 Standard. Please note that Trustwave has not verified the fixes. Revision History: 04/21/22 - Vulnerability disclosed to vendor 05/06/22 - Patch released by vendor 07/21/23 - Advisory published References 1. https://www.project-redcap.org/ About Trustwave: Trustwave helps businesses fight cybercrime, protect data and reduce security risk. With cloud and managed security services, integrated technologies and a team of security experts, ethical hackers and researchers, Trustwave enables businesses to transform the way they manage their information security and compliance programs. More than three million businesses are enrolled in the Trustwave TrustKeeper® cloud platform, through which Trustwave delivers automated, efficient and cost-effective threat, vulnerability and compliance management. Trustwave is headquartered in Chicago, with customers in 96 countries. For more information about Trustwave, visit https://www.trustwave.com. About Trustwave SpiderLabs: SpiderLabs(R) is the advanced security team at Trustwave focused on application security, incident response, penetration testing, physical security and security research. The team has performed over a thousand incident investigations, thousands of penetration tests and hundreds of application security tests globally. In addition, the SpiderLabs Research team provides intelligence through bleeding-edge research and proof of concept tool development to enhance Trustwave's products and services. https://www.trustwave.com/spiderlabs Disclaimer: The information provided in this advisory is provided "as is" without warranty of any kind. Trustwave disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Trustwave or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Trustwave or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.