Remote Code Execution Vulnerability in FreeSWITCH by SignalWire
CVE-2018-19911

7.5HIGH

Key Information:

Vendor

Freeswitch

Status
Freeswitch
Vendor
CVE Published:
6 December 2018

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2018-19911?

The vulnerability in FreeSWITCH allows remote attackers to execute arbitrary commands by manipulating the mod_xml_rpc module. This occurs via the API pathways such as api/system or txtapi/system, typically on TCP port 8080, enabling attackers to perform unauthorized actions on the server. The exploit can be initiated through crafted queries, exemplified by the api/system?calc request. Furthermore, attacks may be enhanced through Cross-Site Request Forgery (CSRF) techniques, and the security risk is compounded by the possibility of default credentials being used for the freeswitch account.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

freeswitch_rce
Created by iSafeBlue

References

https://github.com/iSafeBlue/freeswitch_rce/blob/master/f...
x_refsource_MISC
https://github.com/iSafeBlue/freeswitch_rce/blob/master/R...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability Reserved

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

.