Get the latest tech news
Insufficiently sanitized data allows unauthenticated access to FreePBX Admin
We’re back - it’s a day, in a month, in a year - and once again, something has happened. In this week’s episode of “the Internet is made of string and there is literally no evidence to suggest otherwise”, we present even further evidence that as a
The module supports a wide range of vendors, allows for bulk updates, and integrates with FreePBX’s extension management to streamline deployments and maintenance of SIP endpoints across an organization. They’re not exactly single-file scripts, and the call stacks go deep, so instead of making our lives difficult we decided to do what we do best - click around the UI to see how they behave in practice, hoping to really understand how FreePBX routes requests to modules. Carefully, we took that exact request, pointed it at our own lab instance, and – much to our amusement – a shiny new backdoor user named ampuser popped into existence, lining up perfectly with the IoCs FreePBX community members had already been reporting.
Or read this on Hacker News