REDCap Cross-Site Request Forgery Vulnerability in Alert Title Handling

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in REDCap version 14.9.6. The issue arises when uploading a CSV file that includes a list of alert configurations. An attacker could craft a CSV file with an HTML injection payload in the alert title. Once the victim uploads this file, they are directed to a page displaying the uploaded data. If the victim clicks on the alert title, it can either trigger a logout request, terminating their session, or redirect them to a phishing website. This vulnerability exists due to the lack of CSRF protections on the logout functionality.

Impact

Exploitation of this vulnerability can lead to unauthorized session termination or potential phishing attacks.