ALERT MOH Vulnerability in FreePBX

[kenn10]

Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

Summary The FreePBX Music on Hold (MoH) module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreePBX administrator account is required. Common...

community.freepbx.org

Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module

### Summary The FreePBX Music on Hold (MoH) module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk ...

github.com

 

[wardmundy]

The Hits Keep Comin'

 

[kenn10]

The FreeSwitch products like FS PBX and FusionPBX just keep looking better and better.

 

[wardmundy]

I actually feel sorry for all the FreePBX folks that have never heard of a firewall and leave their web portal open to the internet.

 

[hecatae]

This issue was introduced in or before 2015

Blaming music/Music.class.php at 03f53c58e083fae89d6ad365e79bb057e0db9005 · FreePBX/music

Module of FreePBX (Music on Hold) :: Uploading and management of sound files (wav, mp3) to be used for on-hold music. - Blaming music/Music.class.php at 03f53c58e083fae89d6ad365e79bb057e0db9005 · F...

github.com

It's been there for 11 years at minimum.

 

[billsimon]

I'm confused about this vulnerability. I thought it was a feature that you could define any application in MOH as a music source. Apparently it is both a vulnerability and a feature. Is it naive of me to think that if you are an admin user you should be allowed to do these kinds of... admin things?

 

[Samot]

I'm confused about this vulnerability. I thought it was a feature that you could define any application in MOH as a music source. Apparently it is both a vulnerability and a feature. Is it naive of me to think that if you are an admin user you should be allowed to do these kinds of... admin things?

The issue is there's no validation of expected formats, I guess. So you could enter a harmful line that would be executed.