CVE-2019-16965

Vulnerability

In FusionPBX versions up to 4.5.7, the file resources/cmd.php suffers from a command injection vulnerability due to insufficient input validation [1]. The cmd parameter is passed directly to the FreeSwitch Sofia API without sanitization, allowing an attacker to inject arbitrary system commands [2]. The vulnerable code path is reachable from the web interface by any authenticated user with administrative privileges [1][2].

Exploitation

An attacker must have valid administrative credentials to access the resources/cmd.php endpoint [2]. Once authenticated, the attacker can craft a URL containing a malicious cmd parameter that includes shell metacharacters or command separators to execute arbitrary commands on the underlying operating system [1][2]. No additional user interaction or race condition is required; the attack is a simple HTTP request with the injected payload.

Impact

Successful exploitation allows the attacker to execute arbitrary operating system commands on the host running FusionPBX, with the privileges of the www-data user [1][2]. This can lead to full compromise of the application, data exfiltration, modification of configuration files, or lateral movement within the network depending on the host's exposure [2]. The CVSS v3 base score is 7.2 (HIGH), reflecting the high impact on confidentiality, integrity, and availability [2].

Mitigation

The vulnerability was fixed on the same day it was reported, 15 August 2019, by removing the resources/cmd.php file entirely [1][2]. The fix was applied to the 4.4 branch and the master branch; users should upgrade to the latest patched version immediately [2]. If upgrading is not possible, administrators should restrict access to resources/cmd.php via web server configuration or remove the file manually [1][2].