CVE-2025-59429 Overview
CVE-2025-59429 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] affecting the Asterisk HTTP Status page exposed by FreePBX. The flaw impacts FreePBX 16 versions prior to 16.0.68.39 and FreePBX 17 versions prior to 17.0.18.38. FreePBX 16 binds the Asterisk HTTP interface to any available IP address on port 8088 by default, exposing the vulnerable endpoint to the network. FreePBX 17 binds to localhost by default, reducing exposure. Unauthenticated attackers can craft malicious links that steal session cookies from authenticated administrators, enabling full takeover of the FreePBX administrative interface.
Critical Impact
Successful exploitation lets attackers hijack administrator sessions, modify PBX configurations, create backdoor accounts, exfiltrate sensitive telephony data, and disrupt voice services.
Affected Products
- Sangoma FreePBX 16 prior to 16.0.68.39
- Sangoma FreePBX 17 prior to 17.0.18.38
- Asterisk HTTP Status page bound on port 8088
Discovery Timeline
- 2025-10-14 - CVE-2025-59429 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-59429
Vulnerability Analysis
The vulnerability resides in the Asterisk HTTP Status page that FreePBX exposes through the built-in Asterisk HTTP server. The page reflects attacker-controlled input back into the response without proper output encoding or sanitization. An attacker who convinces an authenticated FreePBX administrator to visit a crafted URL can execute arbitrary JavaScript in the administrator's browser context. Because the payload runs in the same origin as the FreePBX web interface, the script can read session cookies and issue authenticated requests to the admin console.
On FreePBX 16, the Asterisk HTTP interface listens on all bound IP addresses at port 8088 by default. This exposes the endpoint to internal networks and, when improperly firewalled, to the public internet. FreePBX 17 restricts the default binding to the loopback interface, significantly reducing the attack surface but not eliminating risk when administrators expose the port for remote monitoring.
Root Cause
The root cause is missing output encoding on parameters reflected by the Asterisk HTTP Status page. User-supplied query values are inserted directly into the HTML response, allowing script tags and event handlers to execute in the victim browser.
Attack Vector
Exploitation requires network access to port 8088 on the FreePBX host and social engineering to lure an authenticated administrator into loading a crafted URL. Attack complexity is low, and user interaction is required. Refer to the FreePBX Security Advisory GHSA-c8g7-475j-fwcc for technical details.
Detection Methods for CVE-2025-59429
Indicators of Compromise
- HTTP requests to port 8088 containing script tags, javascript: URIs, or encoded payloads such as %3Cscript%3E in query parameters
- Administrator sessions originating from unexpected IP addresses or geolocations shortly after a suspicious 8088 request
- Newly created FreePBX admin accounts or unexpected changes to SIP extensions, trunks, or dialplan configuration
- Outbound requests from administrator browsers to unknown domains immediately after visiting external links
Detection Strategies
- Inspect web server and Asterisk HTTP access logs for requests to the status page containing HTML entities, script fragments, or encoded JavaScript
- Correlate administrator login events with prior page views on port 8088 to identify potential session replay
- Monitor FreePBX audit logs for privilege changes, module installs, and backup exports occurring outside normal maintenance windows
Monitoring Recommendations
- Alert on any external network traffic reaching port 8088 on FreePBX hosts
- Capture and retain full URL query strings for HTTP requests to the Asterisk HTTP interface for retrospective analysis
- Track administrator session cookies for concurrent use from multiple source IPs
How to Mitigate CVE-2025-59429
Immediate Actions Required
- Upgrade FreePBX 16 to version 16.0.68.39 or later, and FreePBX 17 to version 17.0.18.38 or later
- Restrict access to port 8088 at the network firewall so it is reachable only from trusted management subnets
- Rotate FreePBX administrator credentials and invalidate active admin sessions after patching
- Review recent configuration changes, extensions, and user accounts for unauthorized modifications
Patch Information
Sangoma has patched the reflected XSS in FreePBX 16.0.68.39 and 17.0.18.38. Full details are available in the FreePBX Security Advisory GHSA-c8g7-475j-fwcc.
Workarounds
- Bind the Asterisk HTTP interface to 127.0.0.1 only, matching the FreePBX 17 default, by editing http.conf and setting bindaddr=127.0.0.1
- Block inbound traffic to TCP port 8088 at perimeter and host firewalls if the HTTP status page is not required
- Require administrators to access the FreePBX UI through a VPN or bastion host to limit exposure to crafted links
- Instruct administrators to avoid clicking links to FreePBX hosts from untrusted sources until patches are applied
# Restrict Asterisk HTTP interface to loopback in /etc/asterisk/http.conf
[general]
enabled=yes
bindaddr=127.0.0.1
bindport=8088
# Reload the HTTP module
asterisk -rx "module reload http"
# Block port 8088 at the host firewall
firewall-cmd --permanent --remove-port=8088/tcp
firewall-cmd --reload
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
