REDCap, developed by Vanderbilt University, is a secure platform designed for data collection in research studies and operations.
REDCap is popular within scientific institutions and universities that require strict compliance with government regulations and data privacy laws when conducting data collection for research purposes. It is particularly useful for managing studies that often contain sensitive or private information.
As a researcher for Trustwave SpiderLabs, a LevelBlue Company, I identified three instances of a stored cross-site scripting (XSS) vulnerability in the REDCap application. When exploited, these vulnerabilities could allow attackers to execute malicious JavaScript code in victims' browsers, potentially compromising sensitive data.
The Vulnerabilities:
The REDCap applications older than version 15.0.27 LTS are vulnerable to XSS caused by failure to correctly encode untrusted data. Although the application has implemented security features to prevent XSS attacks, such as removing HTML event attributes, I was still able to identify an XSS payload that bypassed the security features.
The following locations were affected:
- REDCap Message
- Project Title
- Instrument Name
Although the REDCap session cookie was found to have the 'HttpOnly' attribute set during testing, the identified vulnerabilities could still pose risks to users and their data.
Proof of Concept
Here is a sample Proof of Concept (PoC), which applies to the affected locations listed above.
- Ensure that you’re authenticated to the REDCap application as a standard application user.
- Navigate to the Messenger function by clicking the top navigation bar.
- Create a standard conversation.
- Send a message containing an XSS payload. For example:
Click Me
- Observe that the payload is executed when clicking the "Click Me" link in the message.
This payload, when inserted into various fields within REDCap, creates clickable elements that execute the malicious JavaScript when clicked.
Remediation
The patched versions 15.0.27 LTS and 15.4.3 Standard were released on June 12, 2025. Trustwave strongly recommends that all REDCap users update to the latest version immediately.
CVE Assignment
This vulnerability went through the Trustwave Responsible Disclosure Program. Trustwave has applied for a CVE for this vulnerability as soon as the patched versions were released in June. However, delays with the CVE Program have delayed the CVE assignment. When a CVE is assigned to these vulnerabilities, we will update this post.
