Compliance Impact

The provided information does not specify how this vulnerability directly affects compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability is an Authenticated Local File Inclusion issue in the FreePBX Dashboard module. It occurs because the getcontent AJAX handler uses user-supplied input from the $_REQUEST['rawname'] parameter in an include() call without proper path sanitization.

An attacker with valid credentials can manipulate this parameter using path traversal sequences like ../ to include arbitrary .class.php files from the filesystem. The PHP code in the included file executes before any error occurs, allowing the attacker to execute arbitrary code on the host system.

This affects FreePBX versions prior to 16.0.22 and 17.0.5 and is fixed in those versions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with valid credentials to execute arbitrary PHP code on the server hosting FreePBX. This can lead to unauthorized command execution on the host as the webserver user (typically 'asterisk').

Such code execution can compromise the confidentiality, integrity, and availability of the system, potentially allowing attackers to access sensitive data, disrupt telephony services, or further escalate privileges.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the manipulation of the $_REQUEST['rawname'] parameter in the FreePBX Dashboard module's getcontent AJAX handler to include arbitrary PHP files via path traversal sequences.

To detect exploitation attempts on your system or network, you can monitor web server logs for suspicious requests to the Dashboard module's getcontent AJAX handler that include path traversal patterns such as '../' in the rawname parameter.

Example command to search web server logs for such attempts:

• grep -i "rawname=.*\.\.\/" /var/log/httpd/access_log
• grep -i "rawname=.*\.\.\/" /var/log/apache2/access.log

Additionally, you can use network monitoring tools or intrusion detection systems to alert on HTTP requests containing path traversal sequences targeting the Dashboard module.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should update the FreePBX Dashboard module to version 16.0.22 or later, or 17.0.5 or later, where the issue is fixed.

Additionally, restrict access to the FreePBX Administrator Control Panel to trusted users only.

Deny access to the FreePBX Administrator Control Panel from untrusted networks to reduce the attack surface.

Useful 0 Not Useful 0