FreePBX Asterisk HTTP Status Reflected XSS Vulnerability (CVE-2025-59429) and Mitigation

Critical Vulnerability Information Vulnerability Overview Type: Reflected Cross-site Scripting (XSS) Location: Asterisk HTTP Status Page CVE ID: CVE-2025-59429 CVSS Score: 7.5 (High) Affected Versions Affected Versions: - FreePBX 16: < 16.0.68.39 - FreePBX 17: < 17.0.18.38 Fixed Versions: - FreePBX 16: 16.0.68.39 - FreePBX 17: 17.0.18.38 Description The Asterisk HTTP status page is exposed in FreePBX and, by default, is accessible on port 8088 via any bound IP address in version 16. This vulnerability can be exploited by unauthenticated attackers to steal cookies of logged-in users, enabling session hijacking of administrator accounts. Impact Attackers can gain control of the FreePBX management interface by stealing administrator session cookies, allowing them to access sensitive data, modify system configurations, create backdoor accounts, and cause service disruptions. Indicators of Compromise (IoC) If your FreePBX v16 system exposes port 8088 on a public IP address and an administrator logged into the Admin Control Panel (ACP) during that time, your system may be at risk. It is recommended to thoroughly review system access logs, especially web server access logs. Mitigation Steps 1. Restrict HTTP Status Page to localhost - Navigate to "Advanced Settings" - Change "HTTP Bind Address" to "127.0.0.1" - Submit changes and apply configuration - Restart the Asterisk process 2. Log Out Immediately After Completion - Log out of the ACP to invalidate the session and prevent unauthorized use of stolen cookies. 3. Prevent Malicious Access - Block access from unknown IPs; consider using a VPN, firewall, or similar solutions to prevent potential intrusions.

Goal Reached Thanks to every supporter — we hit 100%!

FreePBX Asterisk HTTP Status Reflected XSS Vulnerability (CVE-2025-59429) and Mitigation

More from this source