## Summary
Issabel Framework (web framework for Issabel PBX) versions prior to commit b97dbaf0b71c1c36f841e672b664afbeb02773bd hard-code an HS256 JWT signing key in pbxapi/index.php. This enables unauthenticated attackers to forge bearer tokens and trigger Asterisk command execution via the manager originate path.
## Technical Details
- Root cause: a static JWT signing secret in pbxapi/index.php ($f3->set('JWT_KEY', 'da893kasdfam43k29akdkfaFFlsdfhj23rasdf');) identical across installations.
- Exploit technique (high level):
- Forge a valid HS256 JWT bearer token using the known signing key.
- Use the forged token to call the manager originate endpoint with the System application parameter.
- Result: Asterisk executes arbitrary OS commands as the Asterisk user.
- Evidence: exploitation was first observed by Shadowserver Foundation on 2026-09-09.
- Patch behavior shown in the referenced commit:
- Require /etc/issabel.conf and a pbxapijwtsecret value.
- Decode the Base64 secret (base64_decode) and set JWT_KEY from it instead of a hard-coded constant.
## Affected
- Issabel Framework (Issabel PBX web framework): before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd.
- Component: pbxapi/index.php.
## Impact
- Unauthenticated remote token forgery (CWE-321) leading to arbitrary OS command execution through Asterisk.
- Execution occurs as the Asterisk user, with high confidentiality/integrity/availability impact (per provided CVSS vector).
## Mitigation
1. Upgrade Issabel Framework to include commit b97dbaf0b71c1c36f841e672b664afbeb02773bd (removes the hard-coded JWT key).
2. Ensure /etc/issabel.conf contains pbxapijwtsecret with at least 32 random bytes encoded as Base64 (as enforced by the patch).
3. Rotate any secrets/credentials potentially exposed during exploitation attempts (given the ability to execute arbitrary commands).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-321