Mitigation Strategies

The immediate mitigation step is to upgrade Asterisk to a patched version where this vulnerability is fixed.

• Upgrade to one of the following versions or later: 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, or 23.2.2.

Until the upgrade can be applied, consider restricting access to the /httpstatus endpoint to trusted users only, for example by network segmentation or firewall rules, to reduce exposure.

Additionally, monitor and filter suspicious HTTP requests that attempt to inject scripts via query parameters or cookies.

Useful 0 Not Useful 0

Executive Summary

[{'type': 'paragraph', 'content': 'CVE-2026-23738 is a Cross-Site Scripting (XSS) vulnerability found in the Asterisk embedded web server, specifically on the /httpstatus page.'}, {'type': 'paragraph', 'content': 'The vulnerability occurs because user-supplied values from Cookies and GET query string parameters are directly inserted into the HTML output of the page without any sanitization or encoding.'}, {'type': 'paragraph', 'content': "This means an attacker can inject malicious scripts into the page by manipulating these inputs, which are then executed in the context of the user's browser."}, {'type': 'paragraph', 'content': 'The issue affects versions of Asterisk prior to 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, where it has been patched.'}] [1]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute malicious scripts in the browsers of users who visit the vulnerable /httpstatus page.

Potential impacts include theft of credentials or tokens, and enabling further attacks such as Cross-Site Request Forgery (CSRF).

Because the attack requires user interaction (the user must visit the maliciously crafted page), the risk is somewhat limited but still significant.

The CVSS score is 3.5 (Low severity), indicating limited confidentiality impact and no impact on integrity or availability.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'This vulnerability can be detected by testing the /httpstatus endpoint of the Asterisk embedded web server for reflected Cross-Site Scripting (XSS). Specifically, you can send HTTP GET requests with crafted query parameters or cookies containing script payloads and observe if these values are reflected unsanitized in the HTML response.'}, {'type': 'list_item', 'content': 'Use curl or similar tools to send requests with script tags in query parameters, for example: curl -i "http://<asterisk-server>/httpstatus?p=<script>alert(1)</script>"'}, {'type': 'list_item', 'content': 'Check the HTTP response for the presence of the injected script tags or payloads in the HTML content.'}, {'type': 'list_item', 'content': 'Similarly, send requests with cookies containing script payloads and verify if they are reflected in the response.'}, {'type': 'paragraph', 'content': 'Detection involves confirming that user-supplied values from Cookies and GET parameters are directly echoed without sanitization, indicating the presence of the vulnerability.'}] [1]

Useful 0 Not Useful 0