Sangoma has released urgent security updates addressing two critical vulnerabilities in FreePBX that could allow unauthenticated attackers to execute arbitrary commands and compromise administrator accounts.
The flaws, both rated 9.3 (Critical) under CVSS-B v4.0, prompted a “Red” urgency classification due to their potential for full system takeover.
Organizations operating internet-exposed FreePBX 16 and 17 instances are strongly advised to apply patches immediately to prevent exploitation.
Critical FreePBX Flaws
The first vulnerability, tracked as GHSA-37j8-fhxx-9vhp, impacts the User Control Panel (UCP) Node server in FreePBX versions prior to 17.0.9. The issue stems from improper authentication enforcement in socket.io communication.
The UCP service listens on port 8001 (non-TLS) and 8003 (TLS), relying on a checkAuth middleware to validate socket connections. However, changes introduced in socket.io v4 removed critical authentication controls that FreePBX implicitly depended on.
As a result, unauthenticated attackers can send crafted socket.io events that are relayed directly to the Asterisk Manager Interface (AMI). This enables arbitrary command execution as the asterisk user without requiring credentials or user interaction.
Security researcher mil1200 discovered the flaw, with GitHub contributor chrsmj coordinating disclosure. Sangoma addressed the issue in FreePBX version 17.0.9.
Administrators can verify their system version by inspecting the x-pjax-version meta tag in the UCP login page HTML source.
The second vulnerability, tracked as GHSA-g27h-xf3q-h3rm, affects the missedcall module in FreePBX 16 (before 16.0.11) and FreePBX 17 (before 17.0.6).
The flaw arises from unsafe SQL query construction. The module logs caller ID names into the database but fails to sanitize input, directly concatenating user-controlled data into SQL statements.
Attackers can exploit this weakness by injecting malicious payloads via the SIP From header. Unlike PSTN CNAM fields, which are limited in length, SIP-based caller ID values can carry arbitrarily long strings, making them ideal for SQL injection attacks.
Successful exploitation allows attackers to manipulate the database, potentially altering administrator credentials or corrupting system data to gain unauthorized access.
Although rated Critical, Sangoma assigned this issue an “Amber” urgency level because the missedcall module is not universally deployed. However, systems that accept anonymous inbound SIP calls remain at high risk.
Mitigation
Sangoma recommends immediate patching of affected systems. In addition, several defensive controls can reduce exposure:
- Enable the FreePBX Firewall module’s Responsive Firewall feature to restrict UCP access to trusted IP addresses with registered SIP endpoints.
- Limit inbound calls to trusted SIP trunks and disable anonymous call acceptance where possible.
- Deploy Session Border Controllers (SBCs) to sanitize SIP headers before they reach FreePBX.
- Enforce multi-factor authentication (MFA) or SAML for administrative access.
- Audit firewall configurations under Connectivity → Firewall for misconfigurations.
Security teams should also review administrative activity logs for indicators of compromise, particularly unauthorized account changes or suspicious AMI interactions.
Both vulnerabilities highlight common yet critical security gaps in VoIP platforms. The UCP flaw resulted from reliance on third-party library behavior (socket.io), while the missedcall issue stems from classic SQL injection due to improper input handling.
These issues underscore the importance of dependency auditing, secure coding practices, and strict input validation in telephony systems exposed to untrusted networks.
Given the low complexity and remote exploitability of both flaws, attackers could weaponize these vulnerabilities rapidly. Organizations should treat patching as a priority to prevent potential service disruption, data compromise, or full system takeover.
No Comment! Be the first one.