#VU22291 Command Injection in FusionPBX


Published: 2019-10-25

Vulnerability identifier: #VU22291

Vulnerability risk: Medium

CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-11410

CWE-ID: CWE-77

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
FusionPBX
Server applications / SCADA systems

Vendor: FusionPBX

Description

The vulnerability allows a remote attacker to execute arbitrary commands on the target system.

The vulnerability exists due to a lack of input validation in the "app/backup/index.php" file in the Backup Module. A remote authenticated administrator can upload a file with a specially crafted filename and execute arbitrary commands on the host.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

FusionPBX: Master

External links
http://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html
http://github.com/fusionpbx/fusionpbx/commit/0f965c89288de449236ad6de4f97960814ce8c84

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.


Latest bulletins with this vulnerability


Multiple vulnerabilities in FusionPBX