The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization

Successful exploitation of CVE-2026-23738 allows an attacker to inject arbitrary JavaScript code into the Asterisk HTTP status page. This can be leveraged to steal user session cookies, redirect users to malicious websites, or deface the page. The impact is amplified if the Asterisk server is publicly accessible or integrated with other systems, as the attacker could potentially gain access to sensitive data or compromise the entire network. While the CVSS score is LOW, the ease of exploitation and potential for lateral movement make this a significant concern, particularly in environments with limited security controls.

Organizations running Asterisk for VoIP services, particularly those with publicly accessible Asterisk servers or those using default configurations, are at risk. Shared hosting environments where multiple users share an Asterisk instance are also vulnerable.

• linux / server:

journalctl -u asterisk | grep -i 'httpstatus'

• generic web:

curl -I http://<asterisk_ip>/httpstatus | grep -i 'set-cookie'

• generic web:

curl 'http://<asterisk_ip>/httpstatus?param=<script>alert(1)</script>' -s | grep '<script>'

1. 2026-02-06Disclosure

   disclosure

1. 已保留2026-01-15
2. 发布日期2026-02-06
3. EPSS 更新日期2026-03-23

The primary mitigation for CVE-2026-23738 is to upgrade Asterisk to version 23.2.3 or later, which contains the fix. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter out malicious input in Cookies and GET parameters targeting the /httpstatus endpoint. Input validation on the server-side can also help prevent the injection of malicious scripts. Regularly review Asterisk configuration to ensure the /httpstatus endpoint is not publicly accessible if not required.