FreePBX arimanager Views cross site scripting

Successful exploitation of CVE-2019-25090 allows an attacker to inject arbitrary JavaScript code into the FreePBX ariManager interface. This can be leveraged to steal user session cookies, allowing the attacker to impersonate legitimate users. The attacker could also modify the content displayed to users, potentially leading to phishing attacks or defacement of the ariManager interface. Given ariManager’s role in managing FreePBX features, a compromised instance could provide an attacker with a foothold into the broader telephony system.

Organizations utilizing FreePBX with ariManager versions 13.0.5.0 through 13.0.5.3 are at risk. This includes businesses relying on FreePBX for their telephony infrastructure, particularly those with publicly accessible ariManager instances or those with limited security monitoring in place.

• php: Examine FreePBX logs for unusual activity or attempts to access the Views Handler component with suspicious dataurl parameters. Use grep to search for patterns resembling JavaScript code within log files.

grep -i 'script|alert' /var/log/freepbx/logs/*

1. 2019-07-18Discovery

   discovery

2. 2022-12-27Disclosure

   disclosure

3. 2023-01-12CISA KEV

   kev

1. Gereserveerd2022-12-27
2. Gepubliceerd2022-12-27
3. Gewijzigd2024-08-05
4. EPSS bijgewerkt2026-04-02

The primary mitigation for CVE-2019-25090 is to upgrade FreePBX ariManager to version 13.0.5.4 or later, which includes the fix (patch identifier: 199dea7cc7020d3c469a86a39fbd80f5edd3c5ab). If an immediate upgrade is not feasible, consider implementing input validation and sanitization on the dataurl parameter to prevent malicious input. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. After upgrading, confirm the fix by attempting to inject a simple JavaScript payload via the dataurl parameter and verifying that it is properly sanitized.