PT-2018-15159 · Signalwire+1 · Freeswitch+1

B1U3R · Published 2018-12-06 · Updated 2020-08-24 · CVE-2018-19911

Positive Technologies (AI Summary)

CVSS v2.0

7.6

High

Base vector

AV:N/AC:H/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions FreeSWITCH versions prior to 1.8.3

Description The issue allows remote attackers to execute arbitrary commands when mod xml rpc is enabled. This can be achieved via the api/system or txtapi/system (or api/bg system or txtapi/bg system) query string on TCP port 8080. For example, an attacker can use an api/system?calc URI to exploit this. Additionally, this can also be exploited via CSRF. In some cases, the default password for the freeswitch account can be used.

Recommendations For FreeSWITCH versions prior to 1.8.3, update to version 1.8.3 or later to resolve the issue. As a temporary workaround, consider disabling the mod xml rpc module until a patch is available. Restrict access to the TCP port 8080 to minimize the risk of exploitation. Change the default password for the freeswitch account to prevent unauthorized access.

Exploit

Fix

RCE

CSRF

Command Injection

Weakness Enumeration

CWE-352

CWE-77

Related Identifiers

ALT-PU-2019-1011

CVE-2018-19911

Affected Products

Alt Linux

Freeswitch

References · 8

• 🔥 https://github.com/iSafeBlue/freeswitch_rce/blob/master/README-en.md · Exploit
• 🔥 https://github.com/iSafeBlue/freeswitch_rce/blob/master/freeswitch_rce.py · Exploit
• 🔥 https://github.com/iSafeBlue/freeswitch_rce · Exploit
• https://osv.dev/vulnerability/CVE-2018-19911 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-19911 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19911 · Security Note
• https://errata.altlinux.org/ALT-PU-2019-1011 · Vendor Advisory
• https://packages.altlinux.org/ru/vuln/CVE-2018-19911 · Note