CVE-2023-37599
📋 TL;DR
This vulnerability in Issabel PBX allows remote attackers to access sensitive information through the modules directory without authentication. It affects organizations using Issabel PBX for telephony systems, potentially exposing configuration files, credentials, and other sensitive data.
💻 Affected Systems
- Issabel PBX
📦 What is this software?
Pbx by Issabel
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through credential theft leading to unauthorized telephony access, call interception, and lateral movement to connected systems.
Likely Case
Exposure of configuration files containing database credentials, API keys, and telephony settings that could enable further attacks.
If Mitigated
Limited information disclosure with no direct path to system compromise if proper network segmentation and access controls are implemented.
🎯 Exploit Status
Simple directory traversal or direct file access via web requests. Public proof-of-concept code is available on GitHub.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not available
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Upgrade to a newer version if available or implement workarounds.
🔧 Temporary Workarounds
Restrict modules directory access
linuxAdd .htaccess restrictions to prevent unauthorized access to the modules directory
echo 'Deny from all' > /var/www/html/modules/.htaccess
chmod 644 /var/www/html/modules/.htaccess
Web server configuration hardening
linuxConfigure web server to deny access to sensitive directories
Add 'location /modules { deny all; }' to nginx config or '<Directory /var/www/html/modules> Require all denied </Directory>' to Apache config
🧯 If You Can't Patch
- Implement strict network access controls to limit PBX access to authorized users only
- Monitor access logs for unusual requests to modules directory and implement WAF rules to block directory traversal attempts
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[issabel-ip]/modules/ and check if directory listing or file access is possibleCheck Version:
grep 'Version' /etc/issabel-release || issabel-versionVerify Fix Applied:
Verify that accessing /modules/ returns 403 Forbidden or similar access denied error📡 Detection & Monitoring
Log Indicators:
- HTTP 200 responses to /modules/ paths
- Multiple requests to sensitive file extensions (.conf, .ini, .php) in modules directory
Network Indicators:
- Unusual GET requests to modules directory from unauthorized IPs
- Pattern of directory traversal attempts
SIEM Query:
source="web_logs" AND (uri_path="/modules/*" OR uri_path CONTAINS "/modules/") AND status="200"