bugtraq - FreePBX Remote Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <52dcb2e95bf72d3c73dd46919b343873.squirrel@ssl106.penguinhost.net>
Date: Tue, 14 Feb 2012 22:03:44 -0600
From: dougw@...uxsecurityblog.com
To: bugtraq@...urityfocus.com
Subject: FreePBX Remote Exploit

FreePBX web interface remote vulnerability

The admin username and password for the web interface is stored in plain
text in this publicly accessible file:
http://yourip/admin/modules/framework/bin/gen_amp_conf.php

Which allows a hacker to access the web GUI and view the
secrets(passwords) for each extension in plain test, as well as change the
outbound routes.

Further details on this exploit can be found here:
http://linuxsecurityblog.com/2012/02/freepbx-vulnerable/

This was claimed to have been fixed around December 2011, however the
vulnerability never made it to bugtraq.
http://www.freepbx.org/forum/freepbx/development/security-gen-amp-conf-php

I have confirmed this has been fixed as of:
FreePBX 2.10.0rc1.1 and distro release 1.88.210.57-1

And it appears to have affected versions for at least 1 year prior to
their fix.