Martin Tschirsich

**Name of the Vulnerable Software and Affected Versions** ZITADEL versions 2.59.0 through 4.10.0 **Description** ZITADEL is an open source identity management platform. The Zitadel Action V2 feature, introduced as an early preview in version 2.59.0, beta in 3.0.0, and generally available in 4.0.0, allows developers to customize flows using webhooks. The Action target URLs can point to local hosts, potentially allowing adversaries to gather internal network information and connect to internal services. This is a Server-Side Request Forgery (SSRF) issue. Zitadel Actions expect responses according to specific schemas, which reduces the threat vector. The issue is resolved in version 4.11.1 by checking the target URL against a denylist, denying localhost and loopback IPs by default. A backport to versions 2.x and 3.x was not feasible due to the stage of the functionality and the changes applied since then. **Recommendations** Upgrade to version 4.11.1 or later. If an upgrade is not possible, prevent actions from using unintended endpoints by setting network policies or firewall rules in your infrastructure.

**Name of the Vulnerable Software and Affected Versions** FreePBX versions 2.9 and earlier **Description** The issue allows remote attackers to execute arbitrary commands. This is achieved through the `callmenum` parameter in a 'c' action, specifically targeting the `callme startcall` function in `recordings/misc/callme page.php`. **Recommendations** For FreePBX versions 2.9 and earlier, consider disabling the `callme startcall` function until a patch is available. Restrict access to the `recordings/misc/callme page.php` file to minimize the risk of exploitation. Avoid using the `callmenum` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** FreePBX versions 2.9 and earlier **Description** The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to security breaches. This can be achieved through various parameters and endpoints, including the `context` parameter to "panel/index amp.php" or "panel/dhtml/index.php", the `clid` or `clidname` parameters to "panel/flash/mypage.php", the `PATH INFO` to "admin/views/freepbx reload.php", or the `login` parameter to "recordings/index.php". **Recommendations** For FreePBX versions 2.9 and earlier, update to a version later than 2.9 to resolve the issue. As a temporary workaround, consider restricting access to the specified endpoints and parameters, such as "panel/index amp.php", "panel/dhtml/index.php", "panel/flash/mypage.php", "admin/views/freepbx reload.php", and "recordings/index.php", until a patch is available.