CVE-2019-16976

Vulnerability

In FusionPBX up to version 4.5.7, the file app/destinations/destination_imports.php unsafely includes the $_GET["query_string"] parameter directly into HTML output on two occasions, without sanitization or encoding. This allows an attacker to inject arbitrary JavaScript through a crafted URL parameter. The vulnerable code appears in lines 470 and 940 of the file, where the query_string value is echoed inside the onclick attribute of a button element [1][2].

Exploitation

An attacker must craft a URL that includes a malicious query_string parameter containing JavaScript payloads, such as ?query_string=. The attacker then tricks an authenticated FusionPBX user into visiting that URL. The user's browser will execute the injected script because the server reflects the unsanitized parameter directly into the HTML response without escaping [2]. No special network position or authentication is required for the attacker beyond the ability to deliver the malicious link to a victim.

Impact

Successful exploitation leads to persistent cross-site scripting (XSS) within the victim's browser session. The attacker can execute arbitrary JavaScript in the context of the FusionPBX application, potentially allowing session hijacking, defacement, or access to sensitive information accessible to the authenticated user. The impact is limited to the victim's browser and does not directly compromise the server itself [1][2].

Mitigation

The vulnerability was patched in commit d6ea02d on August 13, 2019, for FusionPBX 4.4 and master branches [1][2]. Users should upgrade to a version after 4.5.7 that includes this fix. As a workaround, administrators can sanitize the query_string input via a web application firewall or modify the file to remove the unsanitized variable from HTML output before a patched version is deployed.