Full Report
FreePBX security advisory (AV26-818)
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in FreePBX Modules
## CVE Details
- **CVE ID:** CVE-2024-42352, CVE-2024-42354, CVE-2024-42355, CVE-2024-42356, CVE-2024-42357, CVE-2024-42358, CVE-2024-42359
- **CVSS Score:** Range from 5.4 to 8.8 (Medium to High)
- **CWE:** Primarily CWE-79 (Cross-site Scripting), CWE-89 (SQL Injection), and CWE-22 (Path Traversal)
## Affected Systems
- **Products:** FreePBX Open Source Modules
- **Versions:**
- **Backup:** v17.0.5.34 to v17.0.10
- **Framework:** v17.0.1 to v17.0.29; versions prior to 16.0.47
- **Missedcall:** v17.0.1 to v17.0.3; versions prior to 16.0.11
- **Music:** versions prior to 17.0.7
- **TTS (Text-to-Speech):** v17.0.1 to v17.0.5.3; versions prior to 16.0.6
- **UCP (User Control Panel):** versions prior to 17.0.9
- **Configurations:** Systems utilizing the web-based administrative interface or User Control Panel.
## Vulnerability Description
This advisory covers a suite of vulnerabilities across various FreePBX modules. The flaws include:
1. **SQL Injection:** Found in multiple modules, allowing an authenticated attacker to execute arbitrary SQL commands via unsanitized input fields.
2. **Cross-Site Scripting (XSS):** Stored and Reflected XSS vulnerabilities in the Framework and UCP modules that could allow an attacker to hijack administrative sessions.
3. **Path Traversal:** Located in the Backup and Music modules, potentially allowing unauthorized access to files on the server filesystem.
## Exploitation
- **Status:** PoC available for certain CVEs; no confirmed widespread exploitation in the wild at the time of reporting.
- **Complexity:** Low to Medium
- **Attack Vector:** Network
## Impact
- **Confidentiality:** High (Potential data theft via SQLi and file access)
- **Integrity:** High (Potential modification of PBX configurations)
- **Availability:** Medium (Potential disruption of telephony services)
## Remediation
### Patches
Users should update the affected modules to the following versions or higher via the FreePBX Module Admin:
- **Backup:** 17.0.11
- **Framework:** 17.0.30 or 16.0.47
- **Missedcall:** 17.0.4 or 16.0.11
- **Music:** 17.0.7
- **TTS:** 17.0.5.4 or 16.0.6
- **UCP:** 17.0.9
### Workarounds
- Restrict access to the FreePBX administrative web interface and UCP to trusted IP addresses only.
- Ensure strong authentication and MFA are enabled for all administrative accounts.
## Detection
- **Indicators of Compromise:** Unusual SQL error logs in `/var/log/asterisk/freepbx_db.log`. Unexpected administrative user creation or modified system settings.
- **Detection methods:** Audit web server access logs for suspicious path traversal patterns (e.g., `../`) or script tags in URL parameters.
## References
- **Vendor Advisory:** hxxps[://]github[.]com/FreePBX/security-reporting/security/advisories/
- **Cyber Centre Bulletin:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/freepbx-security-advisory-av26-818