FreePBX API Module Command Injection Vulnerability

A command injection vulnerability has been identified in the FreePBX API module, affecting versions through 17.0.8. The issue arises in the initiateGqlAPIProcess() function, where GraphQL mutation input fields are directly passed to shell_exec() without proper sanitization or escaping. This vulnerability allows authenticated users with a valid bearer token to execute arbitrary commands on the host system as the web server user.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the underlying host as the web server user.

Reproduction

To reproduce this vulnerability, an authenticated user must send a GraphQL mutation called 'moduleOperations' with backtick-wrapped commands in the 'module' field. The 'initiateGqlAPIProcess' function will execute the commands on the server via 'shell_exec()', leading to command injection.

Remediation

Users can update to FreePBX API module version 17.0.9 or later, where this vulnerability has been patched.