Summary
FreeSWITCH could interpret attacker-controlled SIP REFER data as channel-variable separators when building parameters for a new call leg. A registered caller on a bridged call that takes the off-box transfer path could use this behavior to trigger operating-system command execution with the FreeSWITCH process's privileges.
FreeSWITCH could interpret attacker-controlled SIP REFER data as channel-variable separators when building parameters for a new call leg. A registered caller on a bridged call that takes the off-box transfer path could use this behavior to trigger operating-system command execution with the FreeSWITCH process's privileges.
Affected context
The issue occurs in FreeSWITCH's SIP REFER handling, where raw Refer-To URI parameters and headers are placed into a channel-variable block passed to the originate parser. Deployments may be at risk when SIP REFER is enabled and a caller can take the off-box transfer path; the parser can treat commas in attacker-controlled values as variable separators.
The issue occurs in FreeSWITCH's SIP REFER handling, where raw Refer-To URI parameters and headers are placed into a channel-variable block passed to the originate parser. Deployments may be at risk when SIP REFER is enabled and a caller can take the off-box transfer path; the parser can treat commas in attacker-controlled values as variable separators.
Exploit preconditions
- Attack surface: SIP REFER handling during a bridged call
- Required access: A registered account and the ability to make a call that takes the off-box transfer path
- Trigger point: Processing Refer-To URI parameters or headers while originating a new call leg
- Why exploitation is possible: Attacker-controlled values are inserted into a variable block without safely separating or neutralizing parser delimiters, allowing injected variables to influence pre-answer behavior
- Attack surface: SIP REFER handling during a bridged call
- Required access: A registered account and the ability to make a call that takes the off-box transfer path
- Trigger point: Processing Refer-To URI parameters or headers while originating a new call leg
- Why exploitation is possible: Attacker-controlled values are inserted into a variable block without safely separating or neutralizing parser delimiters, allowing injected variables to influence pre-answer behavior
Why this happens
FreeSWITCH places raw SIP REFER data into a string that is later parsed as channel variables. Because the originate parser treats commas as variable separators, untrusted input can introduce additional variables, including one that invokes a dialplan application before answer. This is an injection flaw in the construction and parsing of command-related input, mapping to CWE-77: Improper Neutralization of Special Elements used in a Command; the resulting command-execution behavior is also related to CWE-94: Improper Control of Generation of Code.
FreeSWITCH places raw SIP REFER data into a string that is later parsed as channel variables. Because the originate parser treats commas as variable separators, untrusted input can introduce additional variables, including one that invokes a dialplan application before answer. This is an injection flaw in the construction and parsing of command-related input, mapping to CWE-77: Improper Neutralization of Special Elements used in a Command; the resulting command-execution behavior is also related to CWE-94: Improper Control of Generation of Code.
Potential impact
- An attacker could execute operating-system commands with the privileges of the FreeSWITCH process.
- The attacker may gain control over or disrupt the affected FreeSWITCH service.
- Sensitive data accessible to the service could be exposed or altered.
- A compromised service could be used as a foothold for further activity, depending on its permissions and network access.
- An attacker could execute operating-system commands with the privileges of the FreeSWITCH process.
- The attacker may gain control over or disrupt the affected FreeSWITCH service.
- Sensitive data accessible to the service could be exposed or altered.
- A compromised service could be used as a foothold for further activity, depending on its permissions and network access.
General mitigation guidance
Defensive approaches focus on preventing untrusted SIP data from becoming parser syntax or executable behavior:
- Build originate parameters using structured APIs or safe encoding rather than concatenating raw values.
- Validate and constrain Refer-To parameters and headers against an explicit schema and allowlist.
- Keep SIP input untrusted across parsing and call-origination boundaries; do not rely solely on later validation.
- Avoid invoking command-capable dialplan behavior from attacker-influenced variables.
- Run FreeSWITCH with only the operating-system and network privileges it needs, limiting potential impact if a parsing flaw is reached.
Defensive approaches focus on preventing untrusted SIP data from becoming parser syntax or executable behavior:
- Build originate parameters using structured APIs or safe encoding rather than concatenating raw values.
- Validate and constrain Refer-To parameters and headers against an explicit schema and allowlist.
- Keep SIP input untrusted across parsing and call-origination boundaries; do not rely solely on later validation.
- Avoid invoking command-capable dialplan behavior from attacker-influenced variables.
- Run FreeSWITCH with only the operating-system and network privileges it needs, limiting potential impact if a parsing flaw is reached.
How teams detect issues like this
- Use static analysis to identify raw SIP-derived values concatenated into originate strings or channel-variable blocks.
- Review SIP REFER handling for delimiter interpretation, variable injection, and paths that invoke command-capable dialplan applications before answer.
- Apply code-review and CI policies that require structured parameter construction and validation at trust boundaries.
- Monitor for unexpected pre-answer dialplan execution or unusual process activity associated with FreeSWITCH.
- Use static analysis to identify raw SIP-derived values concatenated into originate strings or channel-variable blocks.
- Review SIP REFER handling for delimiter interpretation, variable injection, and paths that invoke command-capable dialplan applications before answer.
- Apply code-review and CI policies that require structured parameter construction and validation at trust boundaries.
- Monitor for unexpected pre-answer dialplan execution or unusual process activity associated with FreeSWITCH.
