Authentication flaw

2023-04-2620:15:00

PRIOn knowledge base

www.prio-n.com

authentication flaw

asterisk

database credentials

security vulnerability

freepbx

8.1 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.3%

JSON

Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables. This exposes cleartext authentication credentials for the Asterisk Database (MariaDB/MySQL) and Asterisk Manager Interface. For example, an attacker can make a /ari/asterisk/variable?variable=AMPDBPASS API call.

CPENameOperatorVersion
freepbx_linux_7eq1805
freepbx_linux_7eq1904
freepbx_linux_7eq1910
freepbx_linux_7eq2002
freepbx_linux_7eq2008
freepbx_linux_7eq2011
freepbx_linux_7eq2104
freepbx_linux_7eq2105
freepbx_linux_7eq2109
freepbx_linux_7eq2112

Name	Operator	Version
freepbx_linux_7	eq	1805
freepbx_linux_7	eq	1904
freepbx_linux_7	eq	1910
freepbx_linux_7	eq	2002
freepbx_linux_7	eq	2008
freepbx_linux_7	eq	2011
freepbx_linux_7	eq	2104
freepbx_linux_7	eq	2105
freepbx_linux_7	eq	2109
freepbx_linux_7	eq	2112