CVE-2024-41353
📋 TL;DR
CVE-2024-41353 is a cross-site scripting (XSS) vulnerability in phpipam 1.6 that allows attackers to inject malicious scripts into the group editing interface. This affects administrators who use the vulnerable phpipam installation. Successful exploitation could lead to session hijacking or unauthorized actions.
💻 Affected Systems
- phpipam
📦 What is this software?
Phpipam by Phpipam
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, gain full administrative access to phpipam, and potentially compromise the entire IP address management system and connected infrastructure.
Likely Case
Attackers could perform session hijacking to modify network configurations, create unauthorized users, or exfiltrate sensitive IP address management data.
If Mitigated
With proper input validation and output encoding, the attack would be prevented, though the vulnerable endpoint would remain accessible.
🎯 Exploit Status
Exploitation requires administrative access to the group editing interface
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.6.1 or later
Vendor Advisory: https://github.com/phpipam/phpipam/issues/4147
Restart Required: No
Instructions:
1. Backup your phpipam installation and database. 2. Download the latest version from the official repository. 3. Replace the vulnerable file app/admin/groups/edit-group.php with the patched version. 4. Verify the fix by testing the group editing functionality.
🔧 Temporary Workarounds
Input Validation Workaround
allAdd input sanitization to the edit-group.php file to filter malicious scripts
# Edit app/admin/groups/edit-group.php and add proper input validation
🧯 If You Can't Patch
- Restrict access to the admin group editing interface using network segmentation or firewall rules
- Implement Content Security Policy (CSP) headers to mitigate XSS impact
🔍 How to Verify
Check if Vulnerable:
Check if your phpipam version is 1.6 and if the file app/admin/groups/edit-group.php exists without proper input validationCheck Version:
grep 'version' /path/to/phpipam/functions/classes/class.Common.php | grep -o '[0-9]\.[0-9]'Verify Fix Applied:
Test the group editing functionality with XSS payloads and verify they are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to edit-group.php with script tags or JavaScript payloads
- Multiple failed login attempts followed by group editing requests
Network Indicators:
- HTTP requests containing script tags or JavaScript in group editing parameters
SIEM Query:
source="phpipam_logs" AND (uri="/app/admin/groups/edit-group.php" AND (body CONTAINS "<script>" OR body CONTAINS "javascript:"))