Summary
FreePBX contains an operating system command injection vulnerability in the PBX API module's documentation generator. An authenticated user authorized to access the GraphQL API module may influence a host parameter and cause arbitrary shell commands to run as the FreePBX web or PBX service user.
FreePBX contains an operating system command injection vulnerability in the PBX API module's documentation generator. An authenticated user authorized to access the GraphQL API module may influence a host parameter and cause arbitrary shell commands to run as the FreePBX web or PBX service user.
Affected context
The issue occurs in FreePBX deployments where:
- The PBX API or GraphQL API module is enabled
- An authenticated user is authorized to access the API module interface
- The documentation generator incorporates a user-controlled host parameter into a shell command
- The host value is not sufficiently validated or escaped before command execution
OAuth access-token validation occurs in the affected code path, but it does not establish that the host parameter is safe for shell interpretation.
The issue occurs in FreePBX deployments where:
- The PBX API or GraphQL API module is enabled
- An authenticated user is authorized to access the API module interface
- The documentation generator incorporates a user-controlled host parameter into a shell command
- The host value is not sufficiently validated or escaped before command execution
OAuth access-token validation occurs in the affected code path, but it does not establish that the host parameter is safe for shell interpretation.
Exploit preconditions
- Attack surface: FreePBX PBX API or GraphQL API module interface
- Required access: Authenticated access with authorization to use the API module
- Trigger point: Documentation generation involving the host parameter
- Why exploitation is possible: User-controlled host data is incorporated into a shell command without adequate validation or escaping
- Execution context: The FreePBX web or PBX service account, commonly the
asteriskuser
- Attack surface: FreePBX PBX API or GraphQL API module interface
- Required access: Authenticated access with authorization to use the API module
- Trigger point: Documentation generation involving the host parameter
- Why exploitation is possible: User-controlled host data is incorporated into a shell command without adequate validation or escaping
- Execution context: The FreePBX web or PBX service account, commonly the
asteriskuser
Why this happens
The vulnerability results from constructing a shell command with a parameter that is treated as trusted even though it can be influenced by an authenticated API user. The value is not constrained to an expected host format or safely separated from shell syntax before command execution.
This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. Token validation protects the authorization flow but does not neutralize unsafe data used later in command construction.
The vulnerability results from constructing a shell command with a parameter that is treated as trusted even though it can be influenced by an authenticated API user. The value is not constrained to an expected host format or safely separated from shell syntax before command execution.
This behavior maps to CWE-78: Improper Neutralization of Special Elements used in an OS Command, commonly known as OS command injection. Token validation protects the authorization flow but does not neutralize unsafe data used later in command construction.
Potential impact
- An authenticated user may execute arbitrary shell commands
- The FreePBX service account may be compromised
- PBX configuration, call-routing data, or stored credentials could be exposed or altered
- The attacker could disrupt telephony services or manipulate communications
- Further compromise may be possible if the service account has excessive permissions
- An authenticated user may execute arbitrary shell commands
- The FreePBX service account may be compromised
- PBX configuration, call-routing data, or stored credentials could be exposed or altered
- The attacker could disrupt telephony services or manipulate communications
- Further compromise may be possible if the service account has excessive permissions
General mitigation guidance
Mitigation generally focuses on removing shell interpretation from application workflows and reducing trust in request parameters.
Common defensive patterns include:
- Replacing shell command construction with direct library or process APIs that pass arguments separately
- Enforcing strict allowlist validation for host values using an appropriate hostname or address schema
- Applying context-specific escaping only when a shell is unavoidable
- Separating authorization checks from input validation so both are enforced before execution
- Running web and PBX services with the minimum filesystem, process, and network privileges
- Restricting access to administrative API modules and limiting their exposure to trusted networks
- Avoiding dynamic command execution for documentation generation where a non-shell implementation is available
Mitigation generally focuses on removing shell interpretation from application workflows and reducing trust in request parameters.
Common defensive patterns include:
- Replacing shell command construction with direct library or process APIs that pass arguments separately
- Enforcing strict allowlist validation for host values using an appropriate hostname or address schema
- Applying context-specific escaping only when a shell is unavoidable
- Separating authorization checks from input validation so both are enforced before execution
- Running web and PBX services with the minimum filesystem, process, and network privileges
- Restricting access to administrative API modules and limiting their exposure to trusted networks
- Avoiding dynamic command execution for documentation generation where a non-shell implementation is available
How teams detect issues like this
Detection can include static analysis and code review for string concatenation, interpolation, or formatting of request parameters into shell commands. Reviewers should examine API handlers and documentation-generation paths for host, URL, filename, and similar values that cross into process execution without strict validation.
Runtime monitoring may flag unexpected child processes spawned by the FreePBX web or PBX service, unusual command-line arguments, and API activity associated with documentation generation. Policy enforcement can require approved process-execution wrappers, prohibit shell invocation for web-facing code, and apply automated security scanning to pull requests.
Detection can include static analysis and code review for string concatenation, interpolation, or formatting of request parameters into shell commands. Reviewers should examine API handlers and documentation-generation paths for host, URL, filename, and similar values that cross into process execution without strict validation.
Runtime monitoring may flag unexpected child processes spawned by the FreePBX web or PBX service, unusual command-line arguments, and API activity associated with documentation generation. Policy enforcement can require approved process-execution wrappers, prohibit shell invocation for web-facing code, and apply automated security scanning to pull requests.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
