0 Day FreePBX Exploit?

[jfinstrom (James Finstrom)]

On the OP topic

SECURITY ISSUE - Potential Rest Phone Apps RCE

On the afternoon of December 21, 2021 Sangoma received a report of malicious activity in progress on a fully up to date FreePBX 15 system. Technical details followed very quickly, and engineering was able to act within minutes of the report. Investigation revealed that the vulnerability to be in the FreePBX and PBXact Phone Apps (restapps) module, in published versions 16.0.18.40, 16.0.18.41, 15.0.19.87 and 15.0.19.88. Other major FreePBX or PBXact versions are not affected. The affected module …