Impact

Because Issabel PBX does not validate the origin of state-changing requests to its user-management interface, a successful CSRF attack allows an attacker to:

• Delete any user account — including the primary administrator — without the victim's knowledge.
• Cause Denial of Service (DoS) — by removing all users, no one can log in, making the PBX administration panel completely inaccessible.
• Disrupt telephony services — phone system configuration and management becomes unavailable until the account is manually recovered at the server level.

Affected Version

Attack Scenario

An attacker hosts a malicious HTML page containing a forged HTTP request targeting the delete-user endpoint of the Issabel PBX application. The attack is triggered automatically (or on a button click) when a user who is already authenticated in Issabel visits the malicious page in the same browser. Because the browser automatically includes the victim's session cookies with every request, the server accepts the forged deletion request as legitimate.

No special privileges are required on the attacker's side — only a social-engineering vector (phishing link, malicious ad, etc.) to lure the authenticated administrator to the crafted page.

Key characteristics of this attack:

• No authentication required on the attacker's side.
• Single click (or even zero clicks if `` / auto-submit forms are used) is sufficient to trigger the exploit.
• Any user ID (e.g., id=1, id=2, …) can be targeted by modifying the payload.
• The attack is invisible to the victim; the page can display unrelated content while silently submitting the forged request.

Proof of Concept (Steps to Reproduce)

Prerequisites

• Burp Suite (Community or Professional edition)
• A browser configured to proxy traffic through Burp Suite
• An Issabel PBX 4.0.0-6 instance accessible on the network

Step 1 — Log in as Administrator

Navigate to the Issabel PBX user list page and authenticate with administrator credentials:

Step 2 — Capture the Delete-User Request in Burp Suite

1. With Burp Suite proxy active, click the Delete button next to the target user.
2. In Burp Suite's Proxy → HTTP history, locate the captured DELETE/POST request.
3. Right-click the request and select Engagement Tools → Generate CSRF PoC.

Step 3 — Generate and Save the CSRF Exploit

Burp Suite will produce an HTML page similar to the one below. Save it as a .html file (e.g., csrf_exploit.html):

Note: Replace <Issabel-IP> with the target server's IP address or hostname, and adjust the id value to target a different user account.

Step 4 — Deliver the Exploit to the Authenticated Administrator

Send the csrf_exploit.html file (or a link to where it is hosted) to a user who is currently logged in to Issabel PBX. When the victim opens the page, the form is submitted automatically and the target user is deleted without any confirmation prompt.

Mitigation / Remediation

The following defences should be applied by the vendor and/or system administrators to remediate this vulnerability:

1. Implement CSRF Tokens — Generate a cryptographically random, per-session (or per-request) token and validate it server-side for every state-changing request. Requests that do not carry a valid token must be rejected.

2. SameSite Cookie Attribute — Set the session cookie's SameSite attribute to Strict or Lax to prevent cross-origin requests from carrying the session cookie in most browsers.

3. Verify the Origin / Referer Header — On the server side, reject any state-changing request whose Origin or Referer header does not match the application's own domain.

4. Require Re-authentication for Destructive Actions — Prompt the user to re-enter their password before processing irreversible actions such as deleting user accounts.

5. Apply the Principle of Least Privilege — Ensure that only users with an explicit administrator role can access the user-deletion functionality, reducing the blast radius of a successful attack.

Until a vendor patch is available, administrators are advised to:

• Restrict access to the Issabel PBX administration panel to trusted IP addresses via firewall rules.
• Avoid browsing untrusted websites while logged in to the admin panel.

References

• NVD — CVE-2023-37596
• OWASP — Cross-Site Request Forgery (CSRF)
• CWE-352: Cross-Site Request Forgery (CSRF)
• Issabel PBX Official Website
• IssabelFoundation/issabelPBX on GitHub
• PortSwigger — CSRF

Disclosure Timeline

Author

Sahil Ojha

• Security Researcher
• CVE: CVE-2023-37596

Disclaimer: This repository is published for educational and responsible-disclosure purposes only. The information provided here must not be used to attack systems without explicit written permission from the system owner. The author holds no responsibility for any misuse of this information.