CVE-2019-11408

Vulnerability

The Operator Panel module in FusionPBX 4.4.3 contains a reflected XSS vulnerability in app/operator_panel/index_inc.php. A remote unauthenticated attacker can inject arbitrary JavaScript by placing a phone call with a specially crafted caller ID number. The malicious caller ID is not sanitized before being reflected in the operator panel interface, allowing script execution in the context of the application. [1]

Exploitation

An attacker does not need authentication or any prior access to FusionPBX. They only need to initiate a phone call to a system using the Operator Panel, with a caller ID payload containing JavaScript. When a logged-in operator views the incoming call on the panel, the injected script executes in the operator's browser session.

Impact

Successful exploitation allows arbitrary JavaScript execution within the operator's session. This can be leveraged to perform actions on behalf of the operator, such as stealing session tokens or modifying panel data. The description further notes that this XSS can be chained with a separate, unspecified command injection vulnerability in FusionPBX, potentially leading to full remote code execution on the server. [1]

Mitigation

The fix is implemented in commit 391a23d070f3036d0c7760992f6970b0a76ee4d7 on the FusionPBX repository, which sanitizes the caller ID input. Users should upgrade to a version that includes this commit or apply the patch manually. As of the publication date (2019-06-17), no CVE for the command injection chain was listed in the available references. [1]