CVE-2023-41580 (PHP, published 2023-10-02T13:15Z)
Description: value: Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. This vulnerability allows attackers to enumerate arbitrary fields in the LDAP server and access sensitive data via a crafted POST request.
Severity: nan (CVSS v3 base score: 7.5)
Weakness: CWE-74 \u2014 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Repository: https://github.com/phpipam/phpipam
Files changed:
app/admin/groups/ad-search-group-result.php
app/admin/users/ad-search-result.php
misc/CHANGELOG
Commit message: Bugfix: XSS and LDAP injection in ad-search-group-result.php

Reported by Elias Hohl


Vulnerable code:
require( dirname(__FILE__) . "/../../../functions/adLDAP/src/adLDAP.php");
		if ($authUser == false) {
	$groups = $adldap->group()->search(adLDAP::ADLDAP_SECURITY_GLOBAL_GROUP,true,"*$_POST[dfilter]*");
	print "<li>"._('Invalid baseDN setting for ' . $server->type)."</li>";
	print "<li>"._($server->type . ' account does not have enough privileges for search')."</li>";
		print "	<td>$k</td>";
		print "	<td>$g</td>";
		print "		<a href='' class='btn btn-sm btn-default btn-success groupselect' data-gname='$k' data-gdescription='$g' data-members='$members' data-gid='$k' data-csrf_cookie='$csrf'>"._('Add group')."</a>";
		print "	<div class='adgroup-$k'></div>";
		// search members
		$groupMembers = $adldap->group()->members($k);
		unset($members);
		if($groupMembers!==false) {
				print "<span class='muted'>$m</span><br>";
				$members[] = $m;
			if(isset($members))
			$members = implode(";", $members);
			$members = "";

?>
require( dirname(__FILE__) . "/../../../functions/adLDAP/src/adLDAP.php");
	if ($authUser == false) {
	$escaped_dn = ldap_escape($_POST["dname"], null, LDAP_ESCAPE_DN);
	$userinfo = $adldap->user()->info("$escaped_dn*", array("*"), false, $server->type);
			print "	<td>".escape_input($u['displayname'][0]);
			print "</td>";

Fixed code:
require_once( dirname(__FILE__) . "/../../../functions/adLDAP/src/adLDAP.php");
		if (!$authUser) {
	$esc_dfilter = ldap_escape($_POST["dfilter"], null, LDAP_ESCAPE_FILTER);
	$groups = $adldap->group()->search(adLDAP::ADLDAP_SECURITY_GLOBAL_GROUP, true, "*$esc_dfilter*");
	print "<li>"._('Invalid baseDN setting for ') . escape_input($server->type)."</li>";
	print "<li>".escape_input($server->type). ' '. _('account does not have enough privileges for search')."</li>";
		$esc_k = escape_input($k);
		$esc_g = escape_input($g);

		// search members
		$groupMembers = $adldap->group()->members($k) ?: [];
		$esc_members = !empty($groupMembers) ? escape_input(implode(";", $groupMembers)) : '';

		print "	<td>$esc_k</td>";
		print "	<td>$esc_g</td>";
		print "		<a href='' class='btn btn-sm btn-default btn-success groupselect' data-gname='$esc_k' data-gdescription='$esc_g' data-members='$esc_members' data-gid='$esc_k' data-csrf_cookie='$csrf'>"._('Add group')."</a>";
		print "	<div class='adgroup-$esc_k'></div>";

		if (!empty($groupMembers)) {
				print "<span class='muted'>".escape_input($m)."</span><br>";
require_once( dirname(__FILE__) . "/../../../functions/adLDAP/src/adLDAP.php");
	if (!$authUser) {
	$esc_dname = ldap_escape($_POST["dname"], null, LDAP_ESCAPE_FILTER);
	$userinfo = $adldap->user()->info("*$esc_dname*", array("*"), false, $server->type);
			print "	<td>".escape_input($u['displayname'][0])."</td>";
    + XSS and LDAP injection in ad-search-group-result.php;