This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: phpIPAM < 1.5.1 has an **Authorization Bypass** flaw. π **Consequences**: Attackers can download sensitive subnet data (descriptions, IP ranges, usage rates) without logging in.β¦
π― **Affected**: **phpIPAM** versions **prior to 1.5.1**. π¦ **Component**: The `find_full_subnets.php` script within the phpIPAM application. If you are running an older version, you are at risk!
Q4What can hackers do? (Privileges/Data)
π **Attacker Actions**: Unauthenticated users can access **high-usage IP subnet lists**. π **Data Exposed**: Subnet descriptions, specific IP ranges, and usage rates.β¦
β‘ **Exploitation Threshold**: **LOW**. No authentication required! πͺ No config tweaks needed. Just a simple HTTP request to the vulnerable endpoint is enough to trigger the data leak. Super easy for attackers.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π **Public Exploit**: **YES**. A PoC is available via **Nuclei templates** (projectdiscovery). π Wild exploitation is possible since the logic flaw is straightforward and documented. Don't wait!
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for the endpoint `find_full_subnets.php`. π§ͺ Use Nuclei with the CVE-2023-0678 template. If you get a response with subnet data without being logged in, you are vulnerable! π¨
Q8Is it fixed officially? (Patch/Mitigation)
β **Official Fix**: **YES**. Fixed in **phpIPAM 1.5.1**. π οΈ The vendor patched the authorization check in the commit `1960bd24e8a55796da066237cf11272c44bb1cc4`. Upgrade immediately!
Q9What if no patch? (Workaround)
π§ **No Patch?**: Block access to `find_full_subnets.php` via WAF or firewall rules. π Restrict access to the phpIPAM interface to trusted IPs only. Deny unauthenticated requests to this specific PHP file.
Q10Is it urgent? (Priority Suggestion)
π₯ **Urgency**: **HIGH**. Critical data leak with **zero-auth** exploitation. πββοΈ Patch to v1.5.1+ ASAP. Your internal IP schema is valuable intel for attackers. Don't leave the door open!