Authenticated Low-Privilege Access to Restricted Subnets in phpIPAM

Executive Summary

phpIPAM through version 1.8.3 has a missing authorization vulnerability. Authenticated low-privilege users can view restricted subnets and IP addresses because certain pages skip permission checks. Specifically, customer, location, and NAT pages do not enforce Subnets::check_permission, allowing unauthorized access to sensitive network details.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if low-privilege users can access restricted pages like customer objects.php, single-location.php, or nat_details.php. Verify if they can view IP addresses, CIDRs, hostnames, or MAC addresses from unauthorized sections. Test by attempting to access these pages directly with a low-privilege account.

Useful 0 Not Useful 0

Impact Analysis

Attackers with low-level access could exploit this to gather confidential network information such as IP addresses, CIDRs, hostnames, and MAC addresses from restricted sections. This could lead to further attacks like network reconnaissance or unauthorized access to sensitive systems.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized access to sensitive network information. GDPR requires protection of personal data, and HIPAA mandates safeguarding protected health information. Unauthorized exposure of IP addresses, hostnames, and MAC addresses may violate these regulations by exposing personally identifiable or sensitive network details.

Useful 0 Not Useful 0

Mitigation Strategies

Update phpIPAM to the latest version beyond 1.8.3 to ensure the authorization vulnerability is patched. Review and restrict access permissions for low-privilege users to prevent unauthorized access to customer, location, and NAT pages.

Useful 0 Not Useful 0