إرسال #984968: FusionPBX 5.6.4-dev Command Injection

The full advisory can be located here:
https://github.com/jasonbernier/Dialplan-Escape-RCE/blob/main/advisory.md

FusionPBX 5.6.4-dev attempts to prevent dangerous FreeSWITCH dialplan applications, including system, bgsystem, spawn, bg_spawn, and spawn_stream, from being submitted through the structured dialplan editor. The applications are removed from the editor's visible list, but the server-side handler validates submitted values using two independent negative conditions. A value containing system is rejected by the system condition but accepted by the separate spawn condition, while a value containing spawn is accepted by the system condition. FusionPBX therefore stores values that the validation code appears intended to prohibit and later serializes them into executable FreeSWITCH dialplan XML.

For the direct system dialplan application to execute, the FreeSWITCH variable record disable_system_app_commands must remain enabled, but its value must be false. In the FusionPBX interface this is represented as Name: disable_system_app_commands, Value: false, Enabled: true. FusionPBX ships the value as true, which blocks the command-execution application by default. After changing the value, FreeSWITCH must reload the XML configuration and mod_dptools must be loaded after the change, usually by safely reloading that module or restarting FreeSWITCH.

The separate set-action technique using ${system(...)} is an API-expansion path rather than the direct dialplan application path. It requires disable_system_api_commands=false, the variable record enabled, the applicable API command registered after the configuration change, and FreeSWITCH API expansion enabled at runtime. The two techniques should not be described as having identical prerequisites.

Under FusionPBX's stock permission assignments, the affected dialplan editing, global variable editing, and module-management capabilities are restricted to superadmin. Consequently, the validation defect alone does not produce remote code execution on a stock secure installation. Command execution requires a pre-existing unsafe configuration or a superadmin-equivalent actor who can deliberately weaken the applicable FreeSWITCH control and activate the relevant runtime component. A custom deployment that delegates route editing while system applications are enabled may cross a more meaningful privilege boundary.

When every prerequisite is satisfied and an attacker-controlled call reaches the stored dialplan condition, FreeSWITCH executes the supplied command with the operating-system privileges of the FreeSWITCH service account. In the tested laboratory that process ran as www-data. Potential access is limited by that account's filesystem permissions, service configuration, and operating-system confinement.

A PoC script has been created to execute a reverse shell.

Accurate classification
This should be described as a FusionPBX dialplan validation bypass with conditional authenticated OS command execution, not as an unauthenticated or default-installation RCE. The vendor does not consider it a vulnerability because the relevant FreeSWITCH command interfaces are disabled by default and the complete administrative chain requires superadmin-level capabilities under the stock permission model.

Version tested
FusionPBX 5.6.4-dev master-branch snapshot. Source archive SHA-256: 0624F2AD94EF8A890326E8599ED0330A085EBA4B67E23317A5527EC8C782E13A. Other releases should not be claimed as affected until the same handler logic and surrounding controls are independently verified.

• المصدر: ⚠️ https://github.com/jasonbernier/Dialplan-Escape-RCE/blob/main/exploit.py
• المستخدم: jasonb (UID 98597)
• ارسال: 16/09/2026 09:23 PM (1 شهر منذ)
• الاعتدال: 19/10/2026 11:33 AM (1 month later)
• الحالة: تمت الموافقة
• إدخال VulDB: 422297 [FusionPBX حتى 5.4.4/5.5.7/5.6.5 Dialplan Editor dialplan.php تجاوز الصلاحيات]
• النقاط: 20