CyberRota Analysis
AI-GeneratedFreePBX versions prior to 17.0.9 are vulnerable due to improper authentication checks in the UCP Node server, allowing unauthenticated clients to connect to custom namespaces and execute arbitrary commands via the Asterisk Manager Interface. This critical vulnerability could lead to unauthorized access and control over the Asterisk service, posing significant risks to telephony systems. Organizations using FreePBX should prioritize upgrading to version 17.0.9 to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user. This issue is fixed in version 17.0.9.