Summary
FusionPBX contains an OS command injection flaw in the call-recording download workflow when caller-controlled values are used in recording filename templates. An unauthenticated attacker may influence those values, and commands could execute as the web server user when a privileged user creates a ZIP containing multiple recordings.
FusionPBX contains an OS command injection flaw in the call-recording download workflow when caller-controlled values are used in recording filename templates. An unauthenticated attacker may influence those values, and commands could execute as the web server user when a privileged user creates a ZIP containing multiple recordings.
Affected context
The issue may occur in FusionPBX deployments through version 5.6.5 when the call-recording download functionality is enabled, the record_name filename template incorporates caller ID data, and a privileged user downloads multiple recordings as a ZIP. Risk depends on how caller ID values are accepted, transformed, and passed into filename or operating-system processing.
The issue may occur in FusionPBX deployments through version 5.6.5 when the call-recording download functionality is enabled, the record_name filename template incorporates caller ID data, and a privileged user downloads multiple recordings as a ZIP. Risk depends on how caller ID values are accepted, transformed, and passed into filename or operating-system processing.
Exploit preconditions
- Attack surface: Call-recording and multi-file download functionality
- Required access: No authenticated application access may be required to place calls with attacker-controlled caller ID values
- Trigger point: Processing and archive creation for multiple downloaded recordings
- Required configuration: The
record_nametemplate must incorporate caller ID information - Why exploitation is possible: Caller-controlled data may reach an operating-system command context without adequate separation from shell syntax
- Attack surface: Call-recording and multi-file download functionality
- Required access: No authenticated application access may be required to place calls with attacker-controlled caller ID values
- Trigger point: Processing and archive creation for multiple downloaded recordings
- Required configuration: The
record_nametemplate must incorporate caller ID information - Why exploitation is possible: Caller-controlled data may reach an operating-system command context without adequate separation from shell syntax
Why this happens
The underlying bug is a failure to treat caller ID data as untrusted input before incorporating it into a filename-generation or command-processing path. When shell-sensitive data is concatenated into an operating-system command or interpreted by a shell, attacker-controlled metacharacters can change the command's meaning. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
The underlying bug is a failure to treat caller ID data as untrusted input before incorporating it into a filename-generation or command-processing path. When shell-sensitive data is concatenated into an operating-system command or interpreted by a shell, attacker-controlled metacharacters can change the command's meaning. This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command.
Potential impact
- An attacker may execute commands with the privileges of the web server account
- The application runtime could be compromised
- Call recordings or other accessible data could be disclosed, altered, or deleted
- Server-side persistence or lateral movement could occur
- Service availability could be disrupted
- An attacker may execute commands with the privileges of the web server account
- The application runtime could be compromised
- Call recordings or other accessible data could be disclosed, altered, or deleted
- Server-side persistence or lateral movement could occur
- Service availability could be disrupted
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from recording and archive workflows and reducing trust in caller-controlled metadata.
Common defensive patterns include:
- Using library APIs for file and archive operations instead of shell commands
- Treating caller ID names and numbers as untrusted data
- Applying strict allowlists and length limits to filename components
- Separating data arguments from executable commands through parameterized process interfaces
- Avoiding dynamic filename templates that accept unrestricted external input
- Running the web application with the minimum filesystem and operating-system privileges
- Restricting access to recordings and requiring appropriate authorization for bulk downloads
Mitigation generally focuses on removing shell interpretation from recording and archive workflows and reducing trust in caller-controlled metadata.
Common defensive patterns include:
- Using library APIs for file and archive operations instead of shell commands
- Treating caller ID names and numbers as untrusted data
- Applying strict allowlists and length limits to filename components
- Separating data arguments from executable commands through parameterized process interfaces
- Avoiding dynamic filename templates that accept unrestricted external input
- Running the web application with the minimum filesystem and operating-system privileges
- Restricting access to recordings and requiring appropriate authorization for bulk downloads
How teams detect issues like this
Organizations can assess for this class of issue through:
- Static analysis rules identifying shell execution or command construction that incorporates request, telephony, or metadata fields
- Code review checks for string concatenation in filename, archive, and process-launching paths
- Tests using benign delimiter and shell-sensitive character classes to verify that data remains data
- Runtime monitoring for unexpected child processes spawned by the web application
- Policy enforcement that prohibits shell invocation when a language or library API provides an equivalent operation
- Automated security review tools that flag unsanitized input reaching command execution functions
Organizations can assess for this class of issue through:
- Static analysis rules identifying shell execution or command construction that incorporates request, telephony, or metadata fields
- Code review checks for string concatenation in filename, archive, and process-launching paths
- Tests using benign delimiter and shell-sensitive character classes to verify that data remains data
- Runtime monitoring for unexpected child processes spawned by the web application
- Policy enforcement that prohibits shell invocation when a language or library API provides an equivalent operation
- Automated security review tools that flag unsanitized input reaching command execution functions
