CVE-2023-37798 : Security Advisory and Response

A stored cross-site scripting (XSS) vulnerability in the new REDCap project creation function of Vanderbilt REDCap 13.1.35 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the project title parameter.

Understanding CVE-2023-37798

This CVE involves a stored cross-site scripting (XSS) vulnerability in Vanderbilt REDCap 13.1.35, potentially enabling attackers to execute malicious scripts or HTML.

What is CVE-2023-37798?

CVE-2023-37798 is a stored cross-site scripting (XSS) vulnerability found in the project creation feature of Vanderbilt REDCap 13.1.35. It allows threat actors to insert a malicious payload into the project title parameter, leading to the execution of harmful web scripts or HTML.

The Impact of CVE-2023-37798

This vulnerability could result in unauthorized access to user sessions, sensitive data theft, defacement of web content, or the deployment of malware through infected project creation requests.

Technical Details of CVE-2023-37798

This section provides insights into the vulnerability description, affected systems and versions, and exploitation mechanism.

Vulnerability Description

The vulnerability in the new REDCap project creation function of Vanderbilt REDCap 13.1.35 allows attackers to inject crafted payloads into project titles, leading to the execution of arbitrary web scripts or HTML.

Affected Systems and Versions

Vendor and product information are not available. The specific version 13.1.35 of Vanderbilt REDCap is confirmed as impacted.

Exploitation Mechanism

Exploitation of this vulnerability involves injecting malicious code into the project title parameter. Once successful, attackers can execute arbitrary scripts or HTML on the target system.

Mitigation and Prevention

Here are the immediate steps to take and long-term security practices to prevent exploitation, along with the importance of patching and updates.

Immediate Steps to Take

Disable the project creation function in Vanderbilt REDCap 13.1.35 until a patch is available.
Implement input validation mechanisms to sanitize user input and prevent malicious script injections.

Long-Term Security Practices

Conduct regular security assessments and penetration tests to identify and mitigate vulnerabilities proactively.
Educate users on the risks of XSS attacks and best practices for secure web application development.

Patching and Updates

Stay informed about security updates from Vanderbilt REDCap and apply patches promptly to address known vulnerabilities.