With the recent update, this broke our streaming playing, which we have been using ffmpeg. We originally were using mpg123, but we would run into a CPU loop is there was a network disruption. We didn’t have the same issue using ffmpeg, and that was included in the /usr/bin/ directory of the ISO.
Any way we can add that to the next update so that it is an allowed application?
I’m not sure I totally understand how the CVE was circumvented, as I haven’t read @penguinpbx full post in detail. But skimming it it appears an application whitelist was added. I see others applications added, was curious why ffmpeg was left out. If it can be added in, that would be very helpful.
And maybe there is a better method if I use those others. I was just going with tools that were already available on the freepbx platform.
Ok, so do I just need to submit a comment to allow /usr/bin/ffmpeg to be in the allow list?
For myself, I use the following for the Application:
/usr/bin/ffmpeg -loglevel quiet -re -i -filter:a volume=0.3 -f s16le -acodec pcm_s16le -ac 1 -ar 8000 -
(Yes there is an extra - at the end, and was the way I got it to work, at least for our setup).
I’ve opened it in the issue tracker. When I tried to do a pull request it says I need to be a collaborator. Not really as familiar with Github and adding and revising code. I tend to get code, not contribute.
Try Fork into your own GH account, then make your change there, test, push your changes to your Fork, then go back into GH web GUI for the repo and you should see the button there to make a PR at the top.
Ok, I’ve made a pull request and believe I made the changes that are necessary to whitelist. From what I see in the code, there is a blacklist of switches. I used AI (CoPilot) to give suggestions of what commands to blacklist.
For testing, I modified the module on my nonprod system and that would allow me to save, so I believe those are the changes necessary.
I’m not sure I did the pull request totally correct. I’ve updated it and changed it to a draft for approval. See if you see it now. I did sign off on the CLA.
Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files - Blog / Security - FreePBX Community Forums