FreePBX Music on Hold Module Authenticated RCE (CVE-2024-45562) Advisory

FreePBX Music on Hold (MoH) Module Authentication Bypass Leading to Remote Code Execution Vulnerability Overview Vulnerability ID: GHSA-4g6v-whp9-944g Vulnerability Type: Authenticated Remote Code Execution (RCE) Severity: High CVSS 3.1 Score: 7.5 (Medium) Description: A critical security flaw exists in the FreePBX Music on Hold (MoH) module, allowing authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Attackers must authenticate using an existing FreePBX administrator account. Root Cause: The module accepts a POST parameter defining a custom Asterisk application and stores it in the database without any validation. This data is subsequently written directly to the configuration file. Since this configuration file is not validated, attackers can inject arbitrary commands, which are then executed with Asterisk's privileges. Affected Scope Affected Component: FreePBX module Affected Versions: - FreePBX 16: < 16.0.4 - FreePBX 17: < 17.0.6 Impact: Arbitrary OS command execution (running as the FreePBX service user, typically ). Remediation 1. Upgrade the Module: Upgrade the module to the latest version, which restricts the list of allowed applications. 2. Check the Database: Inspect the column in the database tables to identify suspicious entries (which may indicate a prior compromise). 3. Restrict Access: Ensure that only authorized users can access the FreePBX Administration Control Panel (e.g., through FreePBX User Management, SysAdmin VPN, MFA, or SAML modules). 4. Network Isolation: Deny access to the ACP port from the host network via the FreePBX Firewall module. Additional Information CWE Classification: CWE-78 (Improper Neutralization of Special Elements used in an OS Command, 'OS Command Injection') Introduction Date: This issue was introduced in 2015 or earlier. Notes: Users requiring specific executable files (not present in the new allowed list) may need to fork and customize this module, or modify the custom music on hold configuration files generated by the module.

Goal Reached Thanks to every supporter — we hit 100%!

FreePBX Music on Hold Module Authenticated RCE (CVE-2024-45562) Advisory

More from this source