CVE-2025-66039
📋 TL;DR
FreePBX Endpoint Manager versions before 16.0.44 and 17.0.23 contain an authentication bypass vulnerability when using webserver authentication. Attackers can send arbitrary Authorization headers to gain unauthorized access as any user without valid credentials. This affects all FreePBX systems using the vulnerable Endpoint Manager module with webserver authentication enabled.
💻 Affected Systems
- FreePBX Endpoint Manager
📦 What is this software?
Freepbx by Sangoma
Freepbx by Sangoma
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to take over telephony endpoints, intercept calls, modify configurations, and potentially pivot to other systems.
Likely Case
Unauthorized access to endpoint management functions allowing attackers to reconfigure phones, eavesdrop on communications, or disrupt telephony services.
If Mitigated
Limited impact if webserver authentication is disabled or systems are isolated from untrusted networks.
🎯 Exploit Status
Simple HTTP request manipulation with arbitrary Authorization header value.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 16.0.44 or 17.0.23
Vendor Advisory: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-9jvh-mv6x-w698
Restart Required: Yes
Instructions:
1. Log into FreePBX admin interface. 2. Navigate to Module Admin. 3. Check for updates. 4. Update Endpoint Manager to version 16.0.44 or 17.0.23. 5. Apply configuration changes. 6. Restart affected services.
🔧 Temporary Workarounds
Disable webserver authentication
allChange authentication type to a non-webserver method in Endpoint Manager configuration
Network isolation
linuxRestrict access to FreePBX web interface to trusted networks only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_NETWORK -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Change authentication method from 'webserver' to another supported method in Endpoint Manager settings
- Implement strict network access controls to limit exposure to the FreePBX web interface
🔍 How to Verify
Check if Vulnerable:
Check Endpoint Manager version in FreePBX admin interface and verify if webserver authentication is enabledCheck Version:
fwconsole ma list | grep endpointVerify Fix Applied:
Confirm Endpoint Manager version is 16.0.44 or higher (for v16) or 17.0.23 or higher (for v17)📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts with malformed Authorization headers
- Endpoint configuration changes from unexpected IP addresses
- Multiple failed login attempts followed by successful access
Network Indicators:
- HTTP requests to /admin/config.php?display=endpoint with arbitrary Authorization headers
- Unusual traffic patterns to endpoint management endpoints
SIEM Query:
source="freepbx.log" AND ("Authorization:" AND NOT "session=") OR ("endpoint" AND "config.php" AND status=200)🔗 References
- https://github.com/FreePBX/framework/commit/04224253156543cd9932b90458660b2f19fc0e35#diff-72f14a52840a61504a8e03cd195035b44e488aecd634b001bc6412a04bdc940bR20-R50
- https://github.com/FreePBX/security-reporting/security/advisories/GHSA-9jvh-mv6x-w698
- https://www.freepbx.org/watch-what-we-do-with-security-fixes-%f0%9f%91%80
