CVE-2024-10718

Executive Summary

CVE-2024-10718 affects phpipam/phpipam version 1.5.1. The vulnerability is a missing Secure attribute on sensitive cookies during HTTPS sessions. This oversight allows a user agent to transmit session cookies in plaintext over an HTTP session, potentially exposing sensitive authentication data to network eavesdroppers. The issue is remediated in version 1.7.0.

Supply Chain & Package Security

This vulnerability is not in a package manager ecosystem (NPM, PyPI, Go, Ruby). It is a direct application-level misconfiguration in the phpIPAM PHP application. No supply chain compromise is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The low EPSS score (0.0%) indicates that this vulnerability is not currently being actively exploited in the wild. However, the lack of a patch in version 1.5.1 and the simplicity of exploitation (passive network sniffing) make it a significant risk for any deployment using HTTP alongside HTTPS.

Deep Dive & Mechanics

The vulnerability lies in the session cookie configuration of phpIPAM. When the application is served over HTTPS, the Secure flag should be set on session cookies to instruct the browser to only send them over encrypted connections. In version 1.5.1, this flag is absent.

Mechanism:

1. A user authenticates over HTTPS, receiving a session cookie without the Secure attribute.
2. If the user subsequently visits an HTTP page on the same domain (e.g., via a mixed-content redirect or a direct HTTP link), the browser will send the session cookie in plaintext.
3. An attacker on the same network (e.g., public Wi-Fi) can capture this cookie using a packet sniffer.
4. The attacker can then replay the cookie to hijack the user's session.

This is a classic session fixation/hijacking vector, though it specifically relies on the absence of the Secure flag rather than a cryptographic weakness.

Vulnerable vs. Patched Code

Vulnerable (1.5.1): In the session initialization code (likely app/functions/sessions.php or similar), the session cookie parameters are set without the Secure flag.

// Vulnerable snippet (conceptual)
session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'domain' => '',
    'secure' => false, // or omitted
    'httponly' => true
]);

Patched (1.7.0): The fix adds the Secure flag when the request is over HTTPS.

// Patched snippet (conceptual)
$isSecure = (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off') || $_SERVER['SERVER_PORT'] == 443;
session_set_cookie_params([
    'lifetime' => 0,
    'path' => '/',
    'domain' => '',
    'secure' => $isSecure,
    'httponly' => true
]);

The patch dynamically sets the Secure flag based on the current protocol, ensuring cookies are only sent over HTTPS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running phpIPAM 1.5.1 over HTTPS.
• Attacker on the same network segment (e.g., Wi-Fi, LAN) with ability to sniff traffic.
• Victim user who authenticates over HTTPS and then visits an HTTP page on the same domain.

Steps:

1. Sniff Traffic: Use a tool like Wireshark or tcpdump to capture HTTP traffic.

   sudo tcpdump -i eth0 -A port 80 and host target.com
   

2. Wait for Cookie: Monitor for HTTP requests containing the Cookie header.
3. Extract Cookie: Copy the session cookie value.
4. Replay Cookie: Use curl or a browser extension to set the stolen cookie and access the phpIPAM dashboard.

   curl -b "phpipam=STOLEN_COOKIE_VALUE" https://target.com/
   

No public exploit code is available for this CVE.

Blue Team

Detection:

• Monitor for HTTP requests to phpIPAM that contain session cookies (indicating mixed-content usage).
• Alert on any session cookie being transmitted over HTTP (e.g., via a reverse proxy or WAF rule).

Prevention:

• Enforce HTTPS-only access via HSTS headers.
• Redirect all HTTP traffic to HTTPS at the load balancer or web server level.
• Ensure the Secure flag is set in the application configuration.

Lab Setup:

1. Deploy phpIPAM 1.5.1 in a Docker container.
2. Configure Apache/Nginx to serve both HTTP and HTTPS.
3. Use a tool like mitmproxy to simulate an attacker capturing cookies.

Indicators of Compromise (IOCs)

• Network: HTTP requests to phpIPAM endpoints containing a Cookie header.
• Logs: Web server access logs showing GET / with a Cookie header on port 80.
• Session: Unexpected session usage from an IP address that did not perform the initial HTTPS login.

Detection Engineering

YARA Rule

rule CVE_2024_10718_Secure_Cookie_Missing {
    meta:
        description = "Detects missing Secure flag on phpIPAM session cookies in HTTP responses"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10718"
    strings:
        $cookie_header = /Set-Cookie:\s*phpipam=[^;]+(?!.*;\s*secure)/i
    condition:
        $cookie_header
}

Sigma Rule

title: Missing Secure Flag on phpIPAM Session Cookie
id: 7b8c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects HTTP responses from phpIPAM that set a session cookie without the Secure flag.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        response_header|contains: 'Set-Cookie: phpipam='
        response_header|re: 'Set-Cookie: phpipam=[^;]+(?!.*;\s*secure)'
    condition: selection
falsepositives:
    - Legitimate HTTP-only deployments (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10718 - phpIPAM Session Cookie Missing Secure Flag"; flow:to_client; content:"Set-Cookie"; nocase; content:"phpipam="; nocase; pcre:"/Set-Cookie:\s*phpipam=[^;]+(?!.*;\s*secure)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade phpIPAM to version 1.7.0 or later.
2. Workaround: If upgrade is not possible, enforce HTTPS-only access at the web server level:
   • Apache: RewriteEngine On + RewriteCond %{HTTPS} off + RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
   • Nginx: return 301 https://$host$request_uri;
3. Defense in Depth: Implement HSTS header (Strict-Transport-Security: max-age=31536000; includeSubDomains) to force browser HTTPS usage.
4. Monitoring: Deploy the provided detection rules to identify any ongoing exploitation attempts.

Valters IT