2021-12-21 SECURITY: Potential Rest Phone Apps RCE

CVE ID: CVE-2021-45461

Overview:

Remote execution vulnerabilities have been discovered in the ‘Rest Phone apps’ module for FreePBX and PBXact versions 15 and 16.

Discovered By:

Bill Simon

Impact:

• CVSS Base Score: 9.8

• Impact Subscore: 5.4

• Exploitability Subscore: 3.9

• CVSS Temporal Score: 9.4

• CVSS Environmental Score: 7.1

• Modified Impact Subscore: 3.5

• Overall CVSS Score: 7.1

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:O/RC:C/CR:L/IR:L/AR:L/MAV:N/MAC:L/MPR:N/MUI:N/MS:U/MC:X/MI:L/MA:X

Vulnerable software and versions:

The versions listed below:

• Phone Apps (restapps) versions 16.0.18.40, 16.0.18.41, 15.0.19.87, 15.0.19.88

The following versions fix:

• > restapps v15.0.20

• > restapps v16.0.19

Related Information

Official Bug ticket: https://issues.freepbx.org/browse/FREEPBX-23176

Further Details:

Remote execution vulnerabilities exist in the Restapps / Phone apps module. A URL variable could potentially get passed, allowing an RCE.

The Sangoma and FreePBX team has deemed this a major security issue. We strongly encourage all users of FreePBX Distro to upgrade to the latest version of the Phone Apps (restapps) module. This can be done from the Module Admin GUI or fwconsole. For more information on using Module Admin, please seehttps://sangomakb.atlassian.net/wiki/spaces/PG/pages/20023939/Module+Admin+User+Guide .

Sangoma takes security seriously and requests that any future FreePBX security issue be reported at security@sangoma.com.