CVE-2019-19386

Vulnerability

The vulnerability is a cross-site scripting (XSS) flaw in app/voicemail_greetings/voicemail_greeting_edit.php in FusionPBX versions 4.4.1 through 4.5.10 [1]. The application fails to sanitize or validate the id and voicemail_id parameters before rendering them in the page, allowing injection of arbitrary HTML or JavaScript [1][2]. The fix introduces UUID validation for both parameters and uses urlencode() for output in the back button [2].

Exploitation

An attacker can exploit this without authentication by crafting a URL with malicious payloads in the id or voicemail_id query parameters [1]. For example, the proof-of-concept shows: https://domain/app/voicemail_greetings/voicemail_greeting_edit.php?id=123%27%3E%3Csvg/onload=alert(document.domain)%3E%3Ca%20href=%27 [1]. The user interaction required is simply visiting the crafted link; no special privileges or network position are needed beyond access to the web interface [1].

Impact

Successful exploitation allows an attacker to execute arbitrary script in the context of the victim's browser, leading to session hijacking, credential theft, defacement, or redirection to malicious sites [1]. The attacker gains no direct server-side access, but can perform actions as the victim user, potentially compromising the entire FusionPBX configuration if an admin accesses the link [1].

Mitigation

The vulnerability is fixed in commit 9e837fadecdd5199819a949b5b1bd84b19f716f2 [1][2]. The fix adds UUID validation for the id and voicemail_id parameters and URL-encodes the output in the back button [2]. Administrators should update to a version containing this commit (e.g., after November 2019) or apply the patch manually [1]. As of the publication date, no other workaround has been documented, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog.