CVE-2024-23387

Vulnerability

FusionPBX versions prior to 5.1.0 contain a stored cross-site scripting (XSS) vulnerability (CWE-79) [2]. The vulnerability resides in the administrative interface, where an authenticated attacker with admin privileges can inject arbitrary script code that is stored and later executed in the browser of another administrator logging into the system [2].

Exploitation

To exploit this vulnerability, an attacker must be a remote, authenticated user with administrative privileges in FusionPBX. The attacker injects malicious script into a field that is stored by the application (e.g., configuration settings, extension names, or other admin-managed data). When another admin user logs in and views the affected page, the injected script executes in their browser [2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim administrator's session. This can lead to session hijacking, unauthorized actions performed on behalf of the victim, or disclosure of sensitive information displayed in the admin interface [2].

Mitigation

The vulnerability is fixed in FusionPBX version 5.1.0, released in July 2023 [1][2]. Users should upgrade to this version or later. No workarounds are documented in the available references; upgrading is the recommended mitigation [2].