Incorrect Authorization in phpIPAM API User Controller

Executive Summary

phpIPAM through version 1.8.3 has an authorization flaw in the User.php API controller. When the id parameter is set to 'admins' or 'all', the system incorrectly grants access without proper validation. This allows unauthorized users to potentially manipulate token-related parameters and bypass authentication checks due to insufficient input validation and weak token handling.

Useful 0 Not Useful 0

Detection Guidance

Check phpIPAM API logs for unusual token-related requests or failed authentication attempts. Inspect User.php in the api/controllers directory for improper token validation logic. Monitor network traffic for repeated requests to /api/user endpoints with manipulated parameters.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow attackers to gain unauthorized access to the phpIPAM system by manipulating authentication tokens. They might bypass login restrictions, access sensitive data, or perform actions reserved for administrators. Additionally, attackers could exploit the weak token handling to trigger false positives in the IP blocking mechanism, causing denial-of-service conditions for legitimate users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements under GDPR and HIPAA. If exploited, it may result in data breaches, non-compliance with data protection regulations, and potential legal penalties due to inadequate access controls and authentication mechanisms.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade phpIPAM to the latest version if available. Review and restrict API access to trusted IPs. Implement stricter token validation in User.php by adding expiration checks and permission validations. Disable the IP blocking mechanism if it causes false positives.

Useful 0 Not Useful 0