Vulnerability Details

Issabel PBX 4.0.0-6 does not implement CSRF protections (e.g., synchronizer tokens, SameSite cookie attributes, or Origin / Referer header validation) on the user creation endpoint:

Because the application relies solely on session cookies for authentication and performs no state-changing request validation, a forged POST request submitted from any origin will be accepted and processed with the full privileges of the logged-in administrator session.

Root cause: Absence of anti-CSRF token validation on state-changing administrative endpoints.

Vulnerability class: CWE-352 — Cross-Site Request Forgery (CSRF)

Affected Software

• Vendor Homepage: https://www.issabel.org/
• Source Code: https://github.com/IssabelFoundation/issabelPBX

CVSS Score

Attack Scenario

An attacker can exploit this vulnerability by following these high-level steps:

1. Craft a malicious HTML page that contains a hidden form targeting the Issabel PBX user-creation endpoint with attacker-controlled values (username, password, group = administrator).
2. Host the malicious page on a server or send it to the target administrator via phishing email, chat message, or any social-engineering vector.
3. Wait for the administrator to open the link while having an active, authenticated session with the Issabel PBX application.
4. The browser auto-submits the form using the victim's existing session cookie, causing the application to silently create a new administrator account.
5. The attacker logs in with the newly created credentials and has full administrator access to the PBX system, including call routing, recordings, SIP trunk configuration, and all system settings.

No interaction beyond a single page visit is required from the victim.

Proof of Concept (PoC)

⚠️ For educational and authorised testing purposes only.
Replace localhost with the hostname or IP address of the target Issabel PBX instance.
If testing against an https:// endpoint with a self-signed certificate, you must first visit the target URL in the same browser and accept the certificate warning; otherwise the browser will block the cross-origin form submission.

The exploit file is also available in this repository: CSRF Exploit.html

Steps to Reproduce

Prerequisites

• A running Issabel PBX 4.0.0-6 instance.
• An administrator account with an active browser session.
• A browser on the same machine as the administrator session.

Step 1 — Log in to Issabel PBX as Administrator

Navigate to the Issabel PBX web interface and log in with administrator credentials.

Step 2 — Prepare the CSRF Exploit

Copy the PoC HTML code above and save it as a .html file, replacing localhost with the actual hostname or IP address of the target Issabel instance.

The exploit uses hidden form fields to silently POST a new user creation request to the application. When the page loads, the embedded JavaScript immediately submits the form without any visible user action.

Step 3 — Open the Exploit in the Same Browser

Open the saved HTML file in the same browser (in a new tab) while the administrator session is still active. The form will be auto-submitted immediately upon page load.

Step 4 — Verify New Administrator Account Created

Navigate back to the Issabel PBX User Management panel. A new user account (in this PoC, named CSRF) will have been created with full Administrator privileges — without any additional interaction beyond opening the exploit page.

Impact

Successful exploitation of CVE-2023-34839 allows an attacker to:

• Create rogue administrator accounts on the PBX system, providing persistent full-privilege access.
• Modify call routing and SIP trunks, enabling eavesdropping or toll fraud.
• Access voicemail recordings and call detail records (CDRs), leading to sensitive information disclosure.
• Lock out legitimate administrators by changing passwords or deleting existing accounts.
• Disrupt communications by altering or deleting PBX configuration.

Because the rogue account persists even after the victim's session ends, the attacker retains access indefinitely until the account is discovered and removed.

Remediation

Issabel PBX administrators and developers should apply the following mitigations:

1. Implement Anti-CSRF Tokens: Generate a unique, unpredictable, session-tied token for every state-changing form. Validate the token server-side before processing any POST request.

2. Apply SameSite=Strict or SameSite=Lax on Session Cookies: This instructs browsers not to send cookies on cross-site requests, effectively preventing classic CSRF attacks in modern browsers.

3. Validate Origin and Referer Headers: Reject requests whose Origin or Referer header does not match the expected application domain.

4. Require Re-authentication for Sensitive Actions: Prompt the administrator for their current password before allowing the creation of new administrator-level accounts.

5. Apply the Latest Security Patches: Monitor the Issabel release page and the official repository for patches addressing this CVE.

References

• NVD — CVE-2023-34839
• OWASP — Cross-Site Request Forgery (CSRF)
• CWE-352: Cross-Site Request Forgery
• Issabel Official Website
• IssabelFoundation/issabelPBX on GitHub

Disclaimer

This repository is intended strictly for educational purposes and authorised security research. The information and proof-of-concept code provided here must only be used against systems you own or have explicit written permission to test. Unauthorised use of this exploit against systems you do not own is illegal and may result in criminal prosecution. The author assumes no liability for any misuse of the information contained in this repository.