3cx-installer: 3CX Phone System - Installer Page Exposure

id: 3cx-installer

info:
  name: 3CX Phone System - Installer Page Exposure
  author: DhiyaneshDk
  severity: high
  description: |
    A 3CX Phone System installer or setup wizard page is publicly accessible. This web-based configuration tool is used for initial PBX setup including admin credential creation, SIP trunk configuration, license activation, and network settings. Exposure of this page allows unauthenticated attackers to reconfigure or take over the phone system.
  impact: |
    An attacker can access the setup wizard to create admin credentials, modify SIP trunk settings, or take complete control of the PBX without authentication.
  remediation: |
    Restrict access to the 3CX installer and configuration pages to trusted internal networks only. Ensure the setup wizard port (5015) and management console are not exposed to the internet.
  reference:
    - https://www.3cx.com/docs/manual/install/
    - https://www.3cx.com/
  classification:
    cwe-id: CWE-668
  metadata:
    verified: true
    max-request: 1
    vendor: 3cx
    product: 3cx
    shodan-query: http.title:"3CX Phone System Management Console"
    fofa-query: title="3CX Phone System Management Console"
  tags: 3cx,voip,exposure,misconfig,installer,panel

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    host-redirects: true
    max-redirects: 2

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "3CX Configuration Tool"
          - "3CX Initial Setup"
          - "Welcome to the 3CX Management Console"
        condition: or

      - type: status
        status:
          - 200
# digest: 4a0a0047304502200fcb8d407e74cc610627578786b8ecc78a515688701f2d8cad7e884930fc472a022100c26442dff19a8a77fa8077dfe11f3e936cacd2f8df9bf6382f415ccba75ed020:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.