CVE-2023-37597
📋 TL;DR
A Cross-Site Request Forgery (CSRF) vulnerability in Issabel PBX v4.0.0-6 allows remote attackers to delete user groups via forged requests, causing denial of service. This affects administrators who access the PBX web interface while authenticated. Attackers can trick users into visiting malicious pages that trigger unauthorized group deletions.
💻 Affected Systems
- Issabel PBX
📦 What is this software?
Pbx by Issabel
⚠️ Risk & Real-World Impact
Worst Case
Complete disruption of PBX functionality by deleting all user groups, preventing legitimate users from accessing services and requiring manual restoration from backups.
Likely Case
Partial service disruption as attackers delete critical user groups, causing temporary outages for affected users until groups are restored.
If Mitigated
No impact if proper CSRF protections are implemented, as requests would be rejected without valid tokens.
🎯 Exploit Status
Exploitation requires victim to be authenticated and visit malicious page. Simple HTML/JavaScript can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Apply CSRF protection manually or implement workarounds.
🔧 Temporary Workarounds
Implement CSRF Tokens
linuxAdd anti-CSRF tokens to delete user group forms and validate them server-side
Modify PHP files to include CSRF tokens in forms and validate them in processing scripts
SameSite Cookie Attribute
linuxSet SameSite=Strict attribute on session cookies to prevent cross-site requests
session.cookie_samesite = Strict in php.ini or setcookie('session_id', $value, ['samesite' => 'Strict'])
🧯 If You Can't Patch
- Restrict PBX web interface to internal network only using firewall rules
- Implement web application firewall (WAF) with CSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check if delete user group forms lack CSRF tokens by inspecting HTML forms at /index.php?menu=grouplistCheck Version:
grep 'Version' /var/www/html/admin/modules/dashboard/index.php | head -1Verify Fix Applied:
Verify forms now include CSRF tokens and server validates them before processing deletions📡 Detection & Monitoring
Log Indicators:
- Multiple DELETE requests to group management endpoints from unusual IPs
- Group deletion logs without corresponding admin login from same session
Network Indicators:
- HTTP POST requests to delete endpoints without Referer headers matching PBX domain
- Cross-origin requests to PBX from external domains
SIEM Query:
source="apache_access.log" AND uri="/index.php" AND params="menu=grouplist&action=delete" AND NOT referer="*your-pbx-domain*"