CVE-2019-19384

Vulnerability

A reflected cross-site scripting (XSS) vulnerability exists in FusionPBX version 4.4.1 in the file app/fax/fax_log_view.php. The fax_uuid parameter is not properly sanitized before being echoed back in the response, allowing an attacker to inject arbitrary web script or HTML. The fix introduced UUID validation and URL encoding for the parameter, confirming the lack of input validation as the root cause [1]. The vulnerability is also reported to affect version 4.5.10 [2].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL containing JavaScript code in the fax_uuid parameter. No authentication is required; the attack is performed by tricking a victim into clicking the crafted link or by embedding it on a page. A proof-of-concept URL uses the payload 123%27%22%3E%3Csvg/onload=alert(document.domain)%3E%3Ca to execute arbitrary JavaScript in the context of the vulnerable application [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browser of an authenticated or unauthenticated user who visits the crafted URL. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The attack does not require any special privileges and affects the confidentiality and integrity of the user's session [1][2].

Mitigation

The vulnerability has been fixed in commit aea1abaeb12f69dc22967395c528fb2434e316c1, which introduces UUID validation via is_uuid() and URL-encodes the parameter value [1]. Affected users should update to a version that includes this commit. No official release version with the fix is explicitly noted, but upgrading to a recent build of FusionPBX beyond 4.4.1 is recommended. There are no known workarounds for users who cannot immediately update [1][2].