2018-09-11 Framework Reflected XSS
- Nathaniel Halbrooks
SEC-2018-002
Overview:
A XSS Injection vulnerability exists in FreePBX 13, 14 and 15 in the Framework module listed under "Vulnerable software and versions" section
Discovered By:
DcLabs Security Research Group
Ewerson Guimarães (Crash) - Dclabs <crash(at)dclabs(dot)com(dot)br>
Impact:
CVSS 3 Details:
CVSS Base Score: 2.0
Impact Subscore: 1.4
Exploitability Subscore: 0.5
CVSS Temporal Score: 1.6
CVSS Environmental Score: 1.1
Modified Impact Subscore: 0.7
Overall CVSS Score: 1.1
Vulnerable software and versions:
The versions listed below (or less than)
< framework v13.0.195.12
< framework v14.0.3.17
< framework v15.0.1.11
The following versions of fixes:
>= framework v13.0.195.12
>= framework v14.0.3.17
>= framework v15.0.1.11
Related Information
Official Bug ticket: FREEPBX-18161 - Multiple XSS/SQL Vulnerabilities CLOSED
Further Details:
The vulnerability results in arbitrary javascript execution if a user clicks an external malicious link while being logged in as an administrator
The user has to be previously authenticated as a FreePBX administrator and be tricked into clicking an external link that would generate the javascript XSS
The Sangoma and FreePBX team has deemed this a minor security issue. We strongly encourage all users of FreePBX 13, 14 and 15 to upgrade to the latest framework version. This can be done from the Module Admin GUI or fwconsole. For more information on using Module Admin, please see https://sangomakb.atlassian.net/wiki/spaces/PG/pages/20023939/Module+Admin+User+Guide .
Sangoma takes security seriously and request that any future FreePBX security issue be reported at security@freepbx.org.