Critical Authentication Bypass Vulnerability in Sangoma FreePBX

What changed

Sangoma has disclosed a critical authentication bypass vulnerability in its FreePBX software, which is a widely used open-source graphical user interface for managing telephony systems. This vulnerability arises from insufficient sanitization of user-supplied data, enabling unauthenticated users to gain access to the FreePBX Administrator interface.

The flaw can lead to arbitrary database manipulation and potentially remote code execution, posing a severe risk to systems utilizing affected versions.

Who is affected

The vulnerability impacts several versions of FreePBX, specifically versions 15, 16, and 17. Organizations using these versions are at risk of unauthorized access and exploitation.

The following groups are particularly vulnerable:

• Organizations using FreePBX 15.0.66, 16.0.89, and 17.0.3 endpoints.
• Businesses relying on FreePBX for telephony services.
• IT administrators managing FreePBX installations without the latest patches.
• Any users who have not updated their FreePBX systems to the patched versions.

What to do

It is crucial for affected organizations to take immediate action to mitigate the risks associated with this vulnerability. Sangoma has released patches for the affected versions, and users are strongly advised to update their systems without delay.

In addition to updating, organizations should review their security policies and practices to ensure that proper access controls are in place.

• Upgrade FreePBX to versions 15.0.66, 16.0.89, or 17.0.3 to close the vulnerability.
• Implement additional security measures such as firewalls and intrusion detection systems.
• Regularly audit and monitor access logs for any unauthorized access attempts.
• Educate staff on security best practices related to telephony systems.