CyberRota Analysis
AI-GeneratedThe Music on Hold module in FreePBX versions 17.0.1 to 17.0.7 is vulnerable to arbitrary command execution due to insufficient validation of command-line options for media players. An authenticated administrator can exploit this flaw to execute commands with the privileges of the asterisk service user, potentially leading to unauthorized file manipulation and system control. Organizations using affected versions of FreePBX should prioritize upgrading to version 17.0.7 to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration() in Music.class.php. An authenticated administrator can use options that write files, open control channels, or create Asterisk call files because applicationUsesDisallowedPlayerOption() does not reject those arguments, resulting in arbitrary command execution as the asterisk service user. This issue is fixed in version 17.0.7.