Summary:
An unauthenticated remote attacker can run shell commands as the Asterisk user of any FreePBX machine with ‘Recordings’ versions between 13.0.12 and 13.0.26.
Details:
The recordings module lets you playback recorded system files. Due to a coding error and a PHP quirk, certain Ajax requests were unauthenticated when requesting files.
This has been fixed in Recordings 13.0.27.
For PBXact users on version 10.13.66 make sure you upgrade to version 10.13.66-15 or higher to receive the patch. For information on how to update your PBXact system review our wiki here.
For FreePBX Distro users on version 10.13.66 you can either upgrade the Recordings module in module admin to version 13.0.27 or upgrade to FreePBX Distro 10.13.66-15. For information on how to update your FreePBX Distro system review our wiki here.
This vulnerability was discovered by: Adrian Maertins <adrian(dot)maertins(at)gmail(at)com>
Additional Details:
As FreePBX is an appliance, any remote shell access can be leveraged to become root.
Keep in mind for security, performance, and the best user experience be sure you keep ALL modules up to date. Some security and functional updates may be delayed or unreleased by maintainers of 3rd party repositories.
It is also always good practice when requiring internet access to your PBX to run the FreePBX firewall and/or other quality firewalls in front of your system. Limit access via VPNs and where possible, such as Sangoma Phones, take advantage of native phone VPNs to minimize the exposure you must provide to potential hackers by limiting the ports you need to open.
Links to More Information:
http://issues.freepbx.org/browse/FREEPBX-12908
History of Security Vulnerability:
Sangoma takes security issues very seriously and we try to work with security experts who find such vulnerabilities in a cooperative manner in order to maximize the ability to protect the user base with timely patches and appropriately timed communications.
This particular vulnerability was reported and the reporter only provided a short time window of three days before disclosing the vulnerability. As such, we have not been provided adequate time to get a proper CVE which we will be working on and we are providing patches to address the issue and requesting users update their systems immediately to be protected against possible hackers once they see the report and create malware attack scripts to go after FreePBX systems open to the internet.