CVE-2023-26567
📋 TL;DR
This vulnerability in Sangoma FreePBX exposes cleartext database and management interface credentials through global variables. Attackers can retrieve these credentials via API calls, potentially gaining full access to the Asterisk database and management interface. Affects FreePBX installations from version 1805 through 2302 when installed via ISO.
💻 Affected Systems
- Sangoma FreePBX
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the FreePBX system, allowing attackers to read/modify call data, intercept communications, install backdoors, and pivot to other systems using database credentials.
Likely Case
Unauthorized access to Asterisk database containing call records, voicemails, and configuration data, plus potential privilege escalation through manager interface access.
If Mitigated
Limited exposure if API endpoints are properly firewalled and access controls restrict who can query global variables.
🎯 Exploit Status
Exploitation is trivial via HTTP requests to /ari/asterisk/variable endpoint. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 2303 and later
Vendor Advisory: https://www.freepbx.org
Restart Required: Yes
Instructions:
1. Backup your FreePBX configuration. 2. Update FreePBX to version 2303 or later via the web interface or command line. 3. Restart the FreePBX services. 4. Verify credentials are no longer exposed.
🔧 Temporary Workarounds
Restrict API Access
linuxBlock access to the vulnerable /ari/asterisk/variable endpoint using firewall rules or web server configuration.
iptables -A INPUT -p tcp --dport 80 -m string --string '/ari/asterisk/variable' --algo bm -j DROP
iptables -A INPUT -p tcp --dport 443 -m string --string '/ari/asterisk/variable' --algo bm -j DROP
Change Exposed Credentials
linuxImmediately change the AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS credentials in FreePBX configuration.
fwconsole ma refreshsignatures
fwconsole reload
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FreePBX from untrusted networks
- Deploy a web application firewall (WAF) to block requests to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Make an HTTP request to http://[freepbx-ip]/ari/asterisk/variable?variable=AMPDBPASS and check if credentials are returned in cleartext.Check Version:
fwconsole --versionVerify Fix Applied:
After patching, repeat the vulnerable check; it should return an error or empty response instead of credentials.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /ari/asterisk/variable endpoint in web server logs
- Unusual database access from unexpected IP addresses
Network Indicators:
- HTTP GET requests with query parameters for AMPDBPASS, AMPMGRPASS, etc.
- Sudden spikes in API calls to FreePBX
SIEM Query:
source="apache_access.log" AND uri_path="/ari/asterisk/variable" AND query_string="*variable=AMP*"🔗 References
- https://qsecure.com.cy/resources/advisories/sangoma-freepbx-linux-insecure-permissions
- https://www.freepbx.org
- https://www.sangoma.com/products/open-source/
- https://qsecure.com.cy/resources/advisories/sangoma-freepbx-linux-insecure-permissions
- https://www.freepbx.org
- https://www.sangoma.com/products/open-source/
