Authentication Bypass in phpIPAM REST API

Executive Summary

phpIPAM before version 1.8.2 has an authentication bypass vulnerability in its REST API. The issue occurs because the object cache uses keys based only on lookup values without including the searched column. This allows an attacker to write an entry during an app_id lookup and reuse it for an app_code lookup, enabling the use of numeric database row identifiers as valid API tokens. This grants full API access without authentication, allowing attackers to read, write, or delete all IP address management records.

Useful 0 Not Useful 0

Detection Guidance

Check if your phpIPAM version is below 1.8.2. Use commands like curl to query the API endpoints for unexpected access or modifications. Monitor logs for unauthorized API calls or cache-related errors.

Useful 0 Not Useful 0

Impact Analysis

If you use phpIPAM versions prior to 1.8.2, an unauthenticated attacker could exploit this vulnerability to gain full control over your IP address management system. They could access, modify, or delete sensitive network records, potentially disrupting network operations or exposing confidential information. The high CVSS score (9.3) indicates the severity of this risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and modification of sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized changes to IP address management records could result in data breaches, non-compliance penalties, and reputational damage for organizations handling regulated data.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade phpIPAM to version 1.8.2 or later immediately. Disable the REST API if not required. Review API access logs for suspicious activity and restrict API permissions to least privilege.

Useful 0 Not Useful 0