Issabel PBX 4.0.0-6 - Directory Listing

highseverity

7.5CVSS score

3.6%likelihood of exploitation, next 30 days

90%of all CVEs are less likely

Readycheck to confirm it

An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory

Impact

Exploiting this vulnerability could lead to unauthorized access to sensitive directories and files, compromising the confidentiality of the system.

Fix

It is recommended to update to a patched version of issabel-pbx or apply necessary configuration changes to prevent directory listing.

How to confirm it

Send: GET {{BaseURL}}/modules/
Positive when: contains(body, "Index of /modules") and contains_any(body, "issabel", "asterisk_", "billing_") and status_code == 200

Run it with nuclei: nuclei -id CVE-2023-37599 -u <target>

The full check

id: CVE-2023-37599

info:
  name: Issabel PBX 4.0.0-6 - Directory Listing
  author: ritikchaddha
  severity: high
  description: |
    An issue in issabel-pbx v.4.0.0-6 allows a remote attacker to obtain sensitive information via the modules directory
  impact: |
    Exploiting this vulnerability could lead to unauthorized access to sensitive directories and files, compromising the confidentiality of the system.
  remediation: |
    It is recommended to update to a patched version of issabel-pbx or apply necessary configuration changes to prevent directory listing.
  reference:
    - https://github.com/sahiloj/CVE-2023-37599
    - https://nvd.nist.gov/vuln/detail/CVE-2023-37599
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-37599
    cwe-id: CWE-668
    epss-score: 0.03632
    epss-percentile: 0.89637
    cpe: cpe:2.3:a:issabel:issabel-pbx:4.0.0-6:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: issabel
    product: issabel-pbx
    shodan-query: title:"issabel"
    fofa-query: title="issabel"
  tags: cve,cve2023,issabel,issabel-pbx,directory-listing,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/modules/'

    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "Index of /modules")'
          - 'contains_any(body, "issabel", "asterisk_", "billing_")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from