CVE-2020-21057
📋 TL;DR
This CVE describes a directory traversal vulnerability in FusionPBX 4.5.7 that allows authenticated remote attackers to delete arbitrary folders on the system. The vulnerability exists in the folderdelete.php script where improper input validation of the 'folder' parameter enables path traversal attacks. This affects all FusionPBX installations running version 4.5.7.
💻 Affected Systems
- FusionPBX
📦 What is this software?
Fusionpbx by Fusionpbx
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system folders, leading to service disruption, data loss, and potential privilege escalation.
Likely Case
Unauthorized deletion of application folders, configuration files, or user data causing service disruption and data loss.
If Mitigated
Limited impact with proper file permissions and directory restrictions in place.
🎯 Exploit Status
Exploitation requires authenticated access. Public proof-of-concept demonstrates folder deletion via crafted folder parameter.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Fixed in commit 026c3958c3c7ca6b2ff067addc991aac8f41cf11 and later versions
Vendor Advisory: https://github.com/fusionpbx/fusionpbx/commit/026c3958c3c7ca6b2ff067addc991aac8f41cf11
Restart Required: No
Instructions:
1. Update to latest FusionPBX version. 2. Apply commit 026c3958c3c7ca6b2ff067addc991aac8f41cf11. 3. Replace app/edit/folderdelete.php with patched version.
🔧 Temporary Workarounds
Disable folderdelete.php
linuxTemporarily disable the vulnerable script to prevent exploitation
mv /var/www/fusionpbx/app/edit/folderdelete.php /var/www/fusionpbx/app/edit/folderdelete.php.disabled
Implement input validation
allAdd path traversal validation to folder parameter
Add validation: if (strpos($folder, '..') !== false) { die('Invalid folder path'); }
🧯 If You Can't Patch
- Implement strict file permissions to limit damage from folder deletion
- Deploy web application firewall (WAF) with path traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Check if running FusionPBX 4.5.7 and examine app/edit/folderdelete.php for lack of path traversal validationCheck Version:
grep 'software_version' /etc/fusionpbx/config.phpVerify Fix Applied:
Verify commit 026c3958c3c7ca6b2ff067addc991aac8f41cf11 is applied and test folder deletion with traversal attempts📡 Detection & Monitoring
Log Indicators:
- Multiple failed folder deletion attempts
- Unusual folder paths in delete requests
- Access to folderdelete.php with traversal patterns
Network Indicators:
- POST requests to /app/edit/folderdelete.php containing '..' patterns
- Unusual sequence of folder operations
SIEM Query:
source="web_access.log" AND uri="/app/edit/folderdelete.php" AND (request CONTAINS ".." OR request CONTAINS "%2e%2e")🔗 References
- https://github.com/fusionpbx/fusionpbx/commit/026c3958c3c7ca6b2ff067addc991aac8f41cf11
- https://resp3ctblog.wordpress.com/2019/10/28/fusionpbx-path-traversal-4/
- https://github.com/fusionpbx/fusionpbx/commit/026c3958c3c7ca6b2ff067addc991aac8f41cf11
- https://resp3ctblog.wordpress.com/2019/10/28/fusionpbx-path-traversal-4/
