FreePBX Framework Module Authenticated Command Injection Vulnerability

A command injection vulnerability has been identified in the FreePBX framework module, affecting versions 17.0.19.11 prior to 17.0.21. This vulnerability allows authenticated users of the Administrator Control Panel (ACP) to execute arbitrary shell commands by maliciously altering the language settings within the framework module.

Impact

Exploitation of this vulnerability allows for authenticated users to execute arbitrary shell commands on the server.

Remediation

Users are advised to update to FreePBX version 17.0.21 or later. It is also recommended to protect the Administrator Control Panel from unauthorized users, remove users who should not have access, and firewall the FreePBX ACP HTTP, HTTPS, and GraphQL ports.