Critical Authentication Bypass Vulnerability in Sangoma FreePBX

What changed

Sangoma FreePBX has revealed a critical authentication bypass vulnerability affecting versions 15, 16, and 17. The flaw arises from the insufficient sanitization of user-supplied data, which can be exploited to gain unauthorized access to the FreePBX Administrator interface.

This vulnerability poses a serious risk, enabling potential attackers to manipulate databases and execute arbitrary code remotely.

Who is affected

The vulnerability impacts a wide range of users and organizations utilizing Sangoma FreePBX, particularly those operating on the affected versions.

Key affected groups include:

• Organizations using FreePBX versions 15.0.66, 16.0.89, and 17.0.3.
• Businesses relying on FreePBX for telecommunication solutions.
• Developers and system administrators managing FreePBX installations.
• Any users with access to the FreePBX Administrator interface.

What to do

To mitigate the risks associated with this vulnerability, users are strongly advised to update their FreePBX installations to the latest patched versions. The updates have been released to address this critical issue.

Additionally, implementing robust security practices and monitoring for unauthorized access can help safeguard against potential exploitation.

• Upgrade to FreePBX versions 15.0.66, 16.0.89, or 17.0.3 immediately.
• Review access logs for any unauthorized attempts to access the system.
• Consider enhancing overall security measures, including user authentication and data sanitization processes.