Music
Monthly
Arbitrary OS command injection in FreePBX Music on Hold module versions 17.0.1 through 17.0.6 allows an authenticated administrator to execute commands as the asterisk service user by supplying dangerous player arguments through the custom application configuration interface. The validateCustomConfiguration() function in Music.class.php accepted player command-line options for mpg123, mpg321, madplay, ogg123, and cvlc without blocking file-write, FIFO, or network control flags, because the applicationUsesDisallowedPlayerOption() function lacked the blocklist logic needed to reject them. No public exploit code or active exploitation has been identified at time of analysis; the issue is patched in version 17.0.7.
The issue was addressed with improved input sanitization. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
This issue was addressed by using HTTPS when sending information over the network. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
This issue was addressed with improved checks to prevent unauthorized actions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Arbitrary OS command injection in FreePBX Music on Hold module versions 17.0.1 through 17.0.6 allows an authenticated administrator to execute commands as the asterisk service user by supplying dangerous player arguments through the custom application configuration interface. The validateCustomConfiguration() function in Music.class.php accepted player command-line options for mpg123, mpg321, madplay, ogg123, and cvlc without blocking file-write, FIFO, or network control flags, because the applicationUsesDisallowedPlayerOption() function lacked the blocklist logic needed to reject them. No public exploit code or active exploitation has been identified at time of analysis; the issue is patched in version 17.0.7.
The issue was addressed with improved input sanitization. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
This issue was addressed by using HTTPS when sending information over the network. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
The issue was addressed with improved checks. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
This issue was addressed with improved checks to prevent unauthorized actions. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.