CVE-2024-55093
📋 TL;DR
phpIPAM through version 1.7.3 contains a reflected Cross-Site Scripting (XSS) vulnerability in its installation scripts. This allows attackers to inject malicious scripts into web pages viewed by users, potentially stealing session cookies or performing actions on behalf of authenticated users. Organizations using phpIPAM versions up to 1.7.3 are affected.
💻 Affected Systems
- phpIPAM
📦 What is this software?
Phpipam by Phpipam
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal administrator session cookies, gain full administrative access to phpIPAM, and potentially pivot to internal network resources.
Likely Case
Attackers could steal user session cookies, perform unauthorized actions within phpIPAM, or redirect users to malicious sites.
If Mitigated
With proper input validation and output encoding, the impact is limited to script execution in the user's browser context only.
🎯 Exploit Status
Reflected XSS typically requires user interaction (clicking a malicious link) but is straightforward to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit d0caaeba885364fd0521f094511c5d7b11f9da8f
Vendor Advisory: https://github.com/phpipam/phpipam/commit/d0caaeba885364fd0521f094511c5d7b11f9da8f
Restart Required: No
Instructions:
1. Update phpIPAM to the latest version. 2. Apply the specific commit d0caaeba885364fd0521f094511c5d7b11f9da8f if not updating fully. 3. Remove or secure installation scripts after installation.
🔧 Temporary Workarounds
Remove installation scripts
linuxDelete or restrict access to installation scripts after installation is complete
rm -rf /path/to/phpipam/install/
Web Application Firewall (WAF)
allDeploy WAF rules to block XSS payloads targeting installation endpoints
🧯 If You Can't Patch
- Implement Content Security Policy (CSP) headers to restrict script execution
- Ensure installation scripts are not accessible after initial setup
🔍 How to Verify
Check if Vulnerable:
Check if phpIPAM version is 1.7.3 or earlier and if installation scripts are accessibleCheck Version:
grep 'define("VERSION"' /path/to/phpipam/functions/scripts/constants.phpVerify Fix Applied:
Verify the commit d0caaeba885364fd0521f094511c5d7b11f9da8f is applied or version is above 1.7.3📡 Detection & Monitoring
Log Indicators:
- Unusual requests to installation scripts with script tags or JavaScript in parameters
Network Indicators:
- HTTP requests containing script injection patterns to install endpoints
SIEM Query:
source="web_access" AND uri="/install/*" AND (query="*<script*" OR query="*javascript:*")