CVE-2023-37599 Scanner

Issabel PBX is an open-source unified communications platform used by small to medium-sized businesses for managing telephony, voicemail, conferencing, and more. It provides a modular architecture that allows users to extend functionality with additional features, making it a popular choice for customizable and cost-effective communication solutions. Proper configuration and regular updates are critical to maintaining security and performance in production environments.

The directory listing vulnerability, identified as CVE-2023-37599, arises when the web server fails to disable directory browsing for certain directories. This misconfiguration allows unauthorized users to view the contents of directories, potentially exposing sensitive files such as configuration files, logs, or backup data. The vulnerability is rooted in improper access controls within the Issabel PBX software.

Specifically, the vulnerability affects the /modules directory of Issabel PBX. By sending a simple HTTP GET request to this directory, an attacker can retrieve a list of all files and subdirectories within it. This endpoint lacks proper authentication or authorization checks, enabling unauthenticated access to sensitive resources that should be restricted.

If exploited, an attacker can gain unauthorized access to sensitive information, such as configuration files containing credentials, system logs, or proprietary modules. This could lead to further attacks, including privilege escalation, data breaches, or complete compromise of the PBX system. The impact is significant for organizations relying on Issabel PBX for business-critical communications.