Issabel Framework Vulnerability: Critical JWT Signing Key Issue
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- isabell framework (other)
- Patched version
- Not yet available
The Issabel Framework, which supports Issabel PBX software, reportedly contains a hard-coded HS256 JWT signing key. This allows unauthenticated remote attackers to forge valid bearer tokens and execute arbitrary OS commands as the Asterisk user.
What happened
An early warning has been issued for a critical vulnerability in the Issabel Framework. The vulnerability involves a hard-coded HS256 JWT signing key. This key allows unauthenticated remote attackers to forge valid bearer tokens. Attackers can use these tokens to execute arbitrary OS commands as the Asterisk user. The vulnerability is currently being exploited in the wild.
The Issabel Framework is a component of the Issabel PBX software. The specific version range affected by this vulnerability has not been published yet. Users should monitor official sources for updates on affected versions and patches.
What to do about it
- Check your Issabel Framework installation for any signs of unauthorized activity.
- Monitor official sources for updates on the vulnerability and any published patches.
- If a patch becomes available, upgrade your Issabel Framework to the fixed version immediately.
- In the absence of an official fix, consider alternative security measures to protect your system from remote command execution.
- Stay informed by following updates from the National Vulnerability Database and other reputable sources.
How 0Day would have caught this
isabell framework is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the Issabel Framework, you may be affected. The specific version range has not been published yet. Monitor official sources for updates.
What should I do right now?
Check your Issabel Framework installation for any signs of unauthorized activity. Monitor official sources for updates on the vulnerability and any published patches.
Has this been exploited in the wild?
Yes, the vulnerability is reportedly being exploited in the wild.