Description

Issabel is an open-source Unified Communications platform built on top of Asterisk PBX. Its web management interface is served by the issabel-pbx package. In version 4.0.0-6, the web server is misconfigured to allow directory listing on the /modules path. Because no access control or authentication check is enforced on this path, an unauthenticated attacker can:

• Browse the directory tree of all installed modules.
• Read PHP source files, configuration files, and helper scripts directly.
• Enumerate module names, internal API endpoints, and application logic.
• Use the disclosed information to craft further targeted attacks (e.g., Local File Inclusion, Remote Code Execution, credential harvesting).

This violates the principle of least privilege and constitutes a Broken Access Control weakness as defined by the OWASP Top 10 (A01:2021).

Impact

• Confidentiality — High. Sensitive application source code, internal configuration, and module logic are exposed to the internet without authentication.
• Integrity — Medium. Information gained from directory browsing can be used to identify further attack surfaces.
• Availability — Low. The vulnerability itself does not directly disrupt availability, but information gathered could facilitate denial-of-service attacks.

Steps to Reproduce

1. Identify the IP address or hostname of an Issabel PBX instance running issabel-pbx 4.0.0-6.

2. Open a browser (no login or special tools required) and navigate to:

   root@kitploit:~

   https://<ISSABEL_IP>/modules/
   

3. The server responds with a full directory listing of the modules folder, exposing all installed module directories and files.

   

   ---

4. Navigate into any sub-directory to enumerate further files and folders inside each module.

   

   ---

5. Open individual PHP or configuration files directly in the browser to read the application's source code.

   

   ---

6. Continue traversal to access additional sensitive files, such as scripts handling call routing, user management, or system configuration.

   

Root Cause

The vulnerability stems from the Apache (or equivalent web server) configuration serving the Issabel web root not disabling the Options Indexes directive for the /modules directory. When Options Indexes is enabled and no index.php / index.html file is present in a directory, the web server automatically generates and serves a browsable directory listing page.

Remediation

Vendors and administrators should apply one or more of the following mitigations:

1. Disable directory listing in the web server configuration. For Apache, ensure the following is set for the modules directory (or globally):

   root@kitploit:~

   <Directory /var/www/html/modules>
       Options -Indexes
   </Directory>
   

2. Restrict access to the /modules path so it is only accessible from localhost or trusted management networks:

   root@kitploit:~

   <Directory /var/www/html/modules>
       Require ip 127.0.0.1
   </Directory>
   

3. Apply authentication to all paths under the web root that are not intentionally public-facing.

4. Update to a patched version of issabel-pbx once the vendor releases a fix.

References

• CVE-2023-37599 — NVD
• CWE-548: Exposure of Information Through Directory Listing
• OWASP Top 10: A01:2021 – Broken Access Control
• Issabel Official Website
• IssabelFoundation/issabelPBX on GitHub

Disclaimer

This information is provided for educational and research purposes only. The author is not responsible for any misuse of this information. Always obtain proper written authorization before testing any system for vulnerabilities.

Discovered and disclosed by Sahil Ojha