Attack Chain

1. Attacker performs reconnaissance to identify internet-facing Issabel PBX instances.
2. Attacker retrieves the hard-coded HS256 signing key from publicly available repository commits.
3. Attacker crafts a malicious JWT using the compromised secret and signs it to impersonate a privileged administrator.
4. Attacker sends an HTTP request to the '/pbxapi/index.php' endpoint or related API routes with the forged Bearer token in the Authorization header.
5. Attacker makes a request to the 'manager originate' API endpoint, injecting the 'System' application string with a malicious OS command into the request body.
6. The Asterisk service receives the command and interprets the 'System' parameter, spawning a shell process.
7. Arbitrary code executes on the underlying operating system with the permissions of the Asterisk user.

Impact

Successful exploitation grants unauthenticated attackers full remote code execution on Issabel PBX appliances. This allows for total system compromise, including the ability to exfiltrate call records, intercept communications, or pivot into the internal network. Exploitation has been observed in the wild by the Shadowserver Foundation, indicating wide-scale scanning and targeting of vulnerable PBX infrastructure.

Recommendation

• Immediately update Issabel Framework to commit b97dbaf or later to remove the hard-coded secret and implement unique per-installation key management.
• Restrict access to the Issabel PBX management web interface and API endpoints (pbxapi) to trusted management subnets using firewall rules.
• Monitor web server access logs for anomalous POST requests to 'pbxapi/index.php' followed by 'manager originate' parameters.
• Review all scheduled jobs and user accounts on Issabel PBX servers for signs of persistence established by the Asterisk user.