CVE-2024-0787: phpIPAM Authentication Bypass Vulnerability

CVE-2024-0787 Overview

CVE-2024-0787 affects phpIPAM version 1.5.1, an open-source IP address management application. The vulnerability allows attackers to bypass the built-in IP-based brute force protection by manipulating the X-Forwarded-For HTTP header. The get_user_ip() function in class.Common.php trusts this client-controlled header instead of relying on REMOTE_ADDR, letting attackers rotate apparent source IPs to evade account lockouts. This weakness enables credential guessing against any user, including the admin account. The issue is tracked under [CWE-307: Improper Restriction of Excessive Authentication Attempts] and is fixed in phpIPAM version 1.7.0.

Critical Impact
Attackers can bypass IP-based lockout controls to brute force administrator credentials on exposed phpIPAM 1.5.1 instances.

Affected Products

phpIPAM version 1.5.1
phpIPAM versions prior to 1.7.0
Deployments relying on the built-in IP block mechanism for authentication protection

Discovery Timeline

2024-11-15 - CVE-2024-0787 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-0787

Vulnerability Analysis

phpIPAM implements an IP block mechanism that tracks failed authentication attempts and blocks source addresses that exceed a threshold. The mechanism relies on the get_user_ip() helper to identify the client. In version 1.5.1, this helper preferentially returns the value of the X-Forwarded-For header when present, and only falls back to the TCP-level REMOTE_ADDR when the header is absent.

Because X-Forwarded-For is an arbitrary request header set by the client, an attacker can send a unique value on every login attempt. Each request is treated as originating from a different address, so the failed-attempt counter never accumulates against a single source. The brute force protection is effectively neutralized without any authentication or user interaction.

Root Cause

The root cause is misplaced trust in a client-supplied HTTP header for security-relevant identification. Lines 1044 and 1045 of class.Common.php read $_SERVER['HTTP_X_FORWARDED_FOR'] before consulting REMOTE_ADDR, without validating that the request actually traversed a trusted reverse proxy. Any HTTP client can supply this header directly.

Attack Vector

Exploitation requires network access to the phpIPAM login endpoint. An attacker scripts authentication attempts against /app/login/login_check.php (or similar login handlers), injecting a randomized or incrementing X-Forwarded-For value with each request. Password candidates can be iterated against known usernames such as admin without triggering the IP block. The vulnerability affects confidentiality if credentials are successfully guessed.

// Example exploitation code (sanitized)
// Vulnerable logic pattern in class.Common.php (lines ~1044-1045):
//   if (isset($_SERVER['HTTP_X_FORWARDED_FOR']))
//       return $_SERVER['HTTP_X_FORWARDED_FOR'];
//   return $_SERVER['REMOTE_ADDR'];
//
// An attacker sends repeated login POSTs while rotating the header:
//   POST /app/login/login_check.php HTTP/1.1
//   Host: target
//   X-Forwarded-For: <randomized IPv4>
//   ipamusername=admin&ipampassword=<candidate>

See the Huntr Vulnerability Bounty report for the original disclosure details.

Detection Methods for CVE-2024-0787

Indicators of Compromise

High volume of POST requests to phpIPAM login endpoints with a wide variety of X-Forwarded-For values from a single TCP source.
Repeated authentication failures for privileged accounts such as admin recorded in phpIPAM logs.
X-Forwarded-For values containing private, reserved, or malformed IP addresses on internet-facing deployments.

Detection Strategies

Correlate web server access logs by REMOTE_ADDR rather than X-Forwarded-For to reveal brute force sources that manipulate the header.
Alert when the ratio of unique X-Forwarded-For values to unique REMOTE_ADDR values exceeds a baseline threshold for the login path.
Monitor phpIPAM audit logs for bursts of failed logins against the same username within short windows.

Monitoring Recommendations

Forward web server and phpIPAM application logs to a centralized analytics platform for retention and correlation.
Track authentication success following extended failure sequences as a potential credential compromise signal.
Enable alerting on administrator logins from previously unseen source IPs.

How to Mitigate CVE-2024-0787

Immediate Actions Required

Upgrade phpIPAM to version 1.7.0 or later, which corrects the get_user_ip() logic.
Rotate credentials for all phpIPAM accounts, prioritizing admin and any accounts with elevated privileges.
Restrict access to the phpIPAM management interface to trusted networks or via VPN until patching is complete.

Patch Information

The fix is included in the phpIPAM 1.7.0 release. Review the vendor change in the phpIPAM GitHub commit for the version bump and schema upgrade path. The referenced patch snippet shows the version rollover to 1.7.0:

php

 include('upgrade_queries/upgrade_queries_1.4.php');
 include('upgrade_queries/upgrade_queries_1.5.php');
 include('upgrade_queries/upgrade_queries_1.6.php');
+include('upgrade_queries/upgrade_queries_1.7.php');
// Source: https://github.com/phpipam/phpipam/commit/55c2056068be9f1359e967fcff64db6b7f4d00b5

Workarounds

Configure the upstream reverse proxy or web application firewall to strip inbound X-Forwarded-For headers before they reach phpIPAM.
Enforce multi-factor authentication on the phpIPAM login flow to reduce the value of guessed passwords.
Rate-limit requests to the login endpoint at the reverse proxy based on REMOTE_ADDR rather than trusting forwarded headers.

bash

# Configuration example: strip client-supplied X-Forwarded-For at nginx
# so phpIPAM cannot be tricked by attacker-controlled values.
location /app/login/ {
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Real-IP $remote_addr;
    limit_req zone=login_zone burst=5 nodelay;
    proxy_pass http://phpipam_backend;
}