Authenticated Command Injection in FreePBX

Executive Summary

This vulnerability allows authenticated users with access to FreePBX's GraphQL API module to execute arbitrary shell commands. The issue occurs because the API's documentation generator accepts an authenticated host parameter and uses it to build a shell command without proper validation or escaping. This leads to command injection, allowing attackers to run commands as the FreePBX web/PBX service user (typically asterisk).

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check FreePBX API module version with: fwconsole module list | grep api. If version is below 17.0.9, it is vulnerable. Review API access logs for unusual host parameters or shell command patterns in requests.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow attackers to take full control of the FreePBX system, execute malicious commands, steal data, or disrupt services. Since it requires authenticated access, attackers must first gain valid credentials or exploit another vulnerability to access the API.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations using affected FreePBX versions may face compliance violations, legal penalties, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update FreePBX API module to version 17.0.9 or later using fwconsole ma upgrade api. Restrict API access to authorized users only and block external network access to the API endpoint. Monitor for suspicious activity in logs.

Useful 0 Not Useful 0