FreePBX vulnerabilities

FreePBX prior to 17.0.9 has a vulnerability in the UCP Node server on ports 8001 and 8003, where the checkAuth middleware is applied only to the default Socket.IO namespace. An unauthenticated client can connect to custom namespaces and send crafted event values with CR/LF, allowing arbitrary commands to execute as the asterisk service user.

FreePBX from 16.0.0 until 16.0.11 and 17.0.4 has a vulnerability in the missedcall module, where the Caller ID name from crafted SIP From headers is inserted into an SQL query without escaping. An unauthenticated caller can inject SQL when a monitored extension goes unanswered, allowing modification of administrator accounts and unauthorized remote access.

A vulnerability in FreePBX from version 15.0.42 to before 16.0.45 and 17.0.7 allows unauthenticated users to access the User Control Panel (UCP) using hard-coded initial template credentials if the administrator did not change them immediately after enabling UCP. This issue is fixed in versions 16.0.45 and 17.0.7.

The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based GUI that manages Asterisk, versions prior to 16.0.5 and 17.0.5 are vulnerable to SQL injection by authenticated users with administrator access. Authenticated users with administrative access to the Administrator Control Panel (ACP) can leverage this SQL injection vulnerability to extract sensitive information from the database and execute code on the system as the `asterisk` user with chained elevation to `root` privileges. Users should upgrade to version 16.0.5 or 17.0.5 to receive a fix.

FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module is required. The PBX API module's documentation generator accepts an authenticated host parameter and uses it to build a shell command. The code path validates the generated OAuth access token before execution, but it does not validate or escape host. Compromise results in authenticated arbitrary shell command execution as the FreePBX web/PBX service user (typically asterisk.). This issue has been patched in version 17.0.9.

FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the superfecta module due to unsafe inclusion of arbitrary PHP files, allowing authenticated attackers to execute arbitrary PHP code on the server with the privileges of the web server user. Authentication with a known username is required. The vulnerability is rooted in the options and save_options cases in the Superfecta module's AJAX handler. The code dynamically includes PHP files from the sources/ directory based on user-supplied input. This allows an attacker to execute arbitrary code when combined with arbitrary directory creation (e.g., via the backup module) and file uploads that reveal full paths (e.g., via the soundlang module). This issue has been patched in versions 16.0.40 and 17.0.7.

FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known username that has sufficient access permissions and/or write access to backup files is required. This vulnerability is caused by improper path sanitization in the backup restore functionality, enabling attackers to upload malicious PHP files to the web root directory. This issue has been patched in versions 16.0.72 and 17.0.7.

FreePBX before versions 16.0.10 and 17.0.5 contains a critical vulnerability in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, leading to remote code execution (RCE). Authentication with a known username is required. The issue stems from insufficient path sanitization in the file conversion process, enabling path traversal attacks that place malicious PHP files in the web server's root directory.

FreePBX before versions 16.0.39 and 17.0.7 allows users authenticated via User Control Panel (UCP) to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using specially crafted HTTP strings. Authenticated access to UCP is required. The issue is due to insufficient sanitization of certain URL parameters used by UCP, allowing binaries to be executed on the host server by carefully chaining commands.

FreePBX before versions 16.0.4 and 17.0.6 contains a critical flaw in the Music on Hold (MoH) module that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreePBX administrator account is required. The root cause is that the module accepts a POST parameter defining a custom Asterisk application, stored without sanitization, and later written directly to the musiconhold_additional.conf configuration file, allowing injection of arbitrary commands.

FreePBX from version 17.0.5.34 to 17.0.11 has a vulnerability in the publicKeySave AJAX endpoint in Backup.class.php, which accepts an administrator's SSH key and appends it to authorized_keys without reliably enforcing restrictions. The key grants persistent shell access with the ability to execute arbitrary commands, access FreePBX and call data, modify system files, and disrupt services.

FreePBX from version 17.0.1 to 17.0.7 has a vulnerability in the Music on Hold module that permits dangerous command-line options for /usr/bin/mpg123 and other allowed players. An administrator can use options that write files, open control channels, or create Asterisk call files, resulting in arbitrary command execution as the asterisk user.

FreePBX before versions 16.0.47 and 17.0.30 has a vulnerability in the Framework module that allows a crafted backup to restore the hidden AUTHTYPE setting with the value none. An authenticated user with backup-restore access can disable FreePBX authentication during restoration, bypassing the UI removal of AUTHTYPE=none.

FreePBX before versions 16.0.6 and 17.0.5.4 has a vulnerability in the Text-To-Speech module that allows an administrator to save a TTS destination name that is HTML-encoded, decoded during dialplan generation, passed as an AGI argument, and used to build filenames in agi-bin/propolys-tts.agi. The destination name reaches a raw shell-command execution path, allowing arbitrary OS command execution as the asterisk user.

In FreePBX prior to versions 16.0.22 and 17.0.5, the Dashboard module's getcontent AJAX handler includes PHP files based on user-supplied input without path sanitization. The $_REQUEST['rawname'] parameter is concatenated into an include() call with a .class.php suffix, allowing path traversal via ../ sequences to include arbitrary .class.php files from the filesystem. The included file's PHP code executes before the subsequent class instantiation error occurs.

The CDR Reports module in FreePBX before versions 16.0.50 and 17.0.11 contains an SQL injection vulnerability via the 'order' and 'sort' POST parameters. Authentication with a CDR section access account is required, but full admin privileges are not needed.

In FreePBX prior to 17.0.8, the OAuth2 implementation in the API module does not properly validate client credentials during token issuance. The validateClient() method in ClientRepository.php always returns true, allowing anyone with knowledge of a valid client_id to obtain OAuth2 access tokens without providing the correct client_secret.

In FreePBX before versions 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore operations, allowing Remote Code Execution (RCE) by restoring a crafted backup containing malicious data. Authentication with sufficient privileges is required. Fixed in versions 16.0.71 and 17.0.6.

FreePBX API module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization. An authenticated user with a valid bearer token can execute arbitrary commands on the host as the web server user.

FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an authenticated local privilege escalation exists in the deprecated FreePBX startup script `amportal`. In the deprecated `amportal` utility, the lookup for the `freepbx_engine` file occurs in `/etc/asterisk/` directories. Typically, these are configured by FreePBX as writable by the **asterisk** user and any members of the **asterisk** group. This means that a member of the **asterisk** group can add their own `freepbx_engine` file in `/etc/asterisk/` and upon `amportal` executing, it would exec that file with root permissions (even though the file was created and placed by a non-root user). Version 16.0.45 and 17.0.24 contain a fix for the issue. Other mitigation strategies are also available. Confirm only trusted local OS system users are members of the `asterisk` group. Look for suspicious files in the `/etc/asterisk/` directory (via Admin -> Config Edit in the GUI, or via CLI). Double-check that `live_dangerously = no` is set (or unconfigured, as the default is **no**) in `/etc/asterisk/asterisk.conf` file. Eliminate any unsafe custom use of Asterisk dial plan applications and functions that potentially can manipulate the file system, e.g., System(), FILE(), etc.

FreePBX, an open-source GUI for managing Asterisk, has a reflected cross-site scripting vulnerability on the Asterisk HTTP Status page. Affected versions are prior to 16.0.68.39 for FreePBX 16 and prior to 17.0.18.38 for FreePBX 17. The status page is exposed by default on port 8088 on all bound IPs in version 16, and only on localhost in version 17. Unauthenticated attackers can exploit this to obtain cookies from logged-in users, allowing session hijacking of an administrative user and full control over the FreePBX admin interface.

An access control issue was discovered in Sangoma Technologies FreePBX before cdr versions 15.0.18, 16.0.40, 15.0.16, and 16.0.17. The vulnerability allows modifying a parameter value, e.g., changing extension=self to extension=101, potentially leading to unauthorized access.