#VU22194 Command Injection in FusionPBX - CVE-2019-16964


| Updated: 2019-10-23

Vulnerability identifier: #VU22194

Vulnerability risk: Medium

CVSSv4.0: 6.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2019-16964

CWE-ID: CWE-77

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
FusionPBX
Server applications / SCADA systems

Vendor: FusionPBX

Description

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to a lack of input validation in the "app/call_centers/cmd.php" file. A remote authenticated attacker (with at least permissions call_center_queue_add or call_center_queue_edit) can execute arbitrary commands on the host as www-data.


Mitigation
Install updates released on 15/08/2019 on 4.4 and Master branches.

Vulnerable software versions

FusionPBX: Master

External links
https://github.com/fusionpbx/fusionpbx/commit/2f9e591a4034c3aea70185dcab837946096449bf
https://resp3ctblog.wordpress.com/2019/10/19/fusionpbx-sofia-api-command-injection-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Multiple vulnerabilities in FusionPBX