CVE-2023-43336
📋 TL;DR
This CVE describes an access control vulnerability in Sangoma FreePBX CDR module that allows attackers to bypass authorization by modifying parameter values. Specifically, changing 'extension=self' to another extension number like 'extension=101' enables unauthorized access to call detail records. All FreePBX installations running vulnerable CDR module versions are affected.
💻 Affected Systems
- Sangoma FreePBX CDR Module
📦 What is this software?
Freepbx by Sangoma
Freepbx by Sangoma
Freepbx by Sangoma
Freepbx by Sangoma
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of call detail records including sensitive call metadata, caller/callee information, call durations, and potentially other PBX data through privilege escalation.
Likely Case
Unauthorized access to call records of other extensions, potentially exposing sensitive business communications and customer information.
If Mitigated
Limited impact with proper network segmentation and access controls, though the vulnerability still exists at the application layer.
🎯 Exploit Status
Exploitation requires authenticated access but minimal technical skill. The vulnerability is parameter manipulation which is trivial to exploit once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: CDR module versions 15.0.18, 16.0.40, 15.0.16, and 16.0.17 or later
Vendor Advisory: http://freepbx.com
Restart Required: No
Instructions:
1. Log into FreePBX admin interface. 2. Navigate to Module Admin. 3. Check for CDR module updates. 4. Apply available updates. 5. Verify CDR module version is patched.
🔧 Temporary Workarounds
Restrict Access to CDR Interface
linuxLimit network access to FreePBX administration interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable CDR Module
linuxTemporarily disable the CDR module if not critically needed
fwconsole ma disable cdr
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FreePBX from untrusted networks
- Enable detailed logging and monitoring for unauthorized access attempts to CDR data
🔍 How to Verify
Check if Vulnerable:
Check CDR module version via FreePBX admin interface: Module Admin > Installed Modules > CDRCheck Version:
fwconsole ma list | grep cdrVerify Fix Applied:
Verify CDR module version is 15.0.18, 16.0.40, 15.0.16, 16.0.17 or later📡 Detection & Monitoring
Log Indicators:
- Unauthorized parameter modifications in CDR requests
- Access to CDR data from unexpected user accounts or IPs
- Multiple failed authorization attempts followed by successful CDR access
Network Indicators:
- Unusual patterns of CDR data requests
- Requests with modified 'extension' parameters
SIEM Query:
source="freepbx" AND (event="cdr_access" AND user!=extension) OR (parameter="extension" AND value_changed=true)