PT-2019-12294 · Fusionpbx · Fusionpbx

Dustin Cobb · Published 2019-06-17 · Updated 2022-04-18 · CVE-2019-11409

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FusionPBX version 4.4.3

Description The issue arises from a command injection vulnerability in the Operator Panel module due to insufficient input validation. This allows authenticated non-administrative attackers to execute commands on the host, potentially leading to remote code execution when combined with an existing XSS vulnerability in the same module.

Recommendations For FusionPBX version 4.4.3, consider disabling the exec.php file in the Operator Panel module as a temporary workaround until a patch is available. Restrict access to the Operator Panel module to minimize the risk of exploitation. Avoid using the Operator Panel module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2019-11409

Affected Products

Fusionpbx

References · 8

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/webapp/fusionpbx_operator_panel_exec_cmd_exec.rb · Exploit
• 🔥 https://blog.gdssecurity.com/labs/2019/6/7/rce-using-caller-id-multiple-vulnerabilities-in-fusionpbx.html · Exploit
• 🔥 http://packetstormsecurity.com/files/155344/FusionPBX-Operator-Panel-exec.php-Command-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/47697 · Exploit
• 🔥 http://packetstormsecurity.com/files/153256/FusionPBX-4.4.3-Remote-Command-Execution.html · Exploit
• https://github.com/fusionpbx/fusionpbx/commit/e43ca27ba2d9c0109a6bf198fe2f8d79f63e0611 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-11409 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11409 · Vendor Advisory