CVE-2024-58294
📋 TL;DR
FreePBX 16 contains an authenticated remote code execution vulnerability in the API module. Attackers with valid session credentials can exploit the 'generatedocs' endpoint via bash command injection to execute arbitrary commands and establish remote shell access. This affects all FreePBX 16 installations with the API module enabled.
💻 Affected Systems
- FreePBX
📦 What is this software?
Freepbx by Sangoma
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise allowing attackers to execute arbitrary commands as the web server user, potentially leading to privilege escalation, data exfiltration, lateral movement, and persistent backdoor installation.
Likely Case
Attackers with stolen or compromised credentials gain shell access to the FreePBX server, enabling them to modify configurations, intercept calls, access sensitive data, and use the system as a foothold for further attacks.
If Mitigated
With proper network segmentation, credential protection, and monitoring, exploitation would be detected and contained before significant damage occurs.
🎯 Exploit Status
Exploit requires valid authentication but is trivial to execute once credentials are obtained. Public exploit code is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check FreePBX security updates for version 16 patches
Vendor Advisory: https://www.freepbx.org/
Restart Required: Yes
Instructions:
1. Backup your FreePBX configuration. 2. Update FreePBX to the latest patched version via the admin interface or command line. 3. Restart FreePBX services. 4. Verify the patch is applied.
🔧 Temporary Workarounds
Disable API Module
linuxTemporarily disable the vulnerable API module until patching is possible
Navigate to FreePBX Admin -> Module Admin -> Disable API module
Restrict Network Access
linuxBlock external access to FreePBX web interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s trusted_network -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate FreePBX from critical systems
- Enforce strong authentication policies and monitor for credential compromise
🔍 How to Verify
Check if Vulnerable:
Check if FreePBX version is 16 and API module is enabled in the admin interfaceCheck Version:
fwconsole ma list | grep -i freepbxVerify Fix Applied:
Verify FreePBX version is updated beyond vulnerable version and test API endpoint functionality📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /admin/api/generatedocs endpoint
- Suspicious command execution patterns in system logs
- Multiple failed authentication attempts followed by successful API access
Network Indicators:
- Unusual outbound connections from FreePBX server
- Traffic patterns indicating reverse shell establishment
SIEM Query:
source="freepbx.log" AND (uri="/admin/api/generatedocs" OR cmd="bash" OR cmd="sh")