Description
FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An authenticated user with a valid bearer token can send a GraphQL moduleOperations mutation with backtick-wrapped commands in the module field to execute arbitrary commands on the underlying host as the web server user.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
FreePBX api
Default version status: unaffected
0 to ≤ 17.0.8affected5f194e39a47e5481e8947f9694304d32724175f6unaffected
pkg:github/FreePBX/apiReferences
- https://github.com/FreePBX/api/commit/5f194e39a47e5481e8947f9694304d32724175f6 ↗
- https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/Api.class.php#L546C1-L554C3 ↗
- https://github.com/FreePBX/api/blob/5f194e39a47e5481e8947f9694304d32724175f6/ApiGqlHelper.class.php#L34C1-L36C136 ↗
- https://www.vulncheck.com/advisories/freepbx-api-module-command-injection-via-graphql ↗