Description
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::check_permission. Attackers can open customer objects.php, single-location.php or nat_details.php to read IP addresses, CIDRs, hostnames and MAC addresses from sections they cannot access.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
phpipam phpipam
Default version status: unaffected
0 to ≤ 1.8.3affected
pkg:github/phpipam/phpipamReferences
- https://hackmd.io/@haind/phpipam-tools-cross-section-address-disclosure ↗
- https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/app/tools/customers/customer/objects/ipaddresses.php#L69-L110 ↗
- https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/app/tools/locations/single-location.php#L129-L195 ↗
- https://github.com/phpipam/phpipam/blob/e8010751d491e485acefa5787fb0e518eb948771/app/tools/nat/nat_details.php#L16-L45 ↗
- https://github.com/phpipam/phpipam ↗
- https://www.vulncheck.com/advisories/phpipam-through-1.8.3-missing-authorization-in-customers-locations-and-nat-pages ↗