Adds modules for multiple CVEs for FreePBX (CVE-2025-61675, CVE-2025-61678, CVE-2025-66039) #20846

msutovsky-r7 · 2026-01-05T14:59:49Z

This PR adds modules for multiple CVEs (CVE-2025-61675, CVE-2025-61678, CVE-2025-66039). This PR works as placeholder for now as modules are not finished, but contain the basic exploitation logic. All modules use authentication bypass (CVE-2025-66039). The CVE-2025-61675 describes multiple SQL injections, but the SQLi modules uses only one variant (one for user insertion, the other one for RCE).

~~WORK IN PROGRESS, TREAT AS SUCH~~

The CVE-2025-66039 represents an authentication bypass: when FreePBX uses Webserver Authorization Mode (an option the admin can enable), it allows an attacker to authenticate as any user.

The CVE-2025-61675 describes multiple SQL injections; the modules exploits the SQL injection in the custom extension component. The module chains these vulnerabilities into an unauthenticated SQL injection attack that creates a new fake user and effectively grants an attacker access to the administration.

The CVE-2025-61678 allows unrestricted file uploads via firmware upload, including path traversal. These vulnerabilities allow unauthenticated remote code execution by bypassing authentication and placing a webshell in the web server’s directory.

To setup the environment, perform minimal installation from here. Note that Authorization Type needs to be set to webserver:

Login into FreePBX Administration
Settings -> Advanced Settings
Change Authorization Type to webserver

Split modules into separate PRs

github-actions · 2026-01-05T14:59:57Z

Thanks for your pull request! Before this can be merged, we need the following documentation for your module:

Chocapikk · 2026-01-05T21:03:29Z

modules/exploits/unix/http/freepbx_custom_extension_rce.rb

+    super(
+      update_info(
+        info,
+        'Name' => 'FreePB endpoint SQLi to RCE',


Suggested change

'Name' => 'FreePB endpoint SQLi to RCE',

'Name' => 'FreePBX endpoint SQLi to RCE',

Chocapikk · 2026-01-05T21:04:33Z

modules/exploits/unix/http/freepbx_firmware_file_upload.rb

+    super(
+      update_info(
+        info,
+        'Name' => 'FreePBX firmeware file upload',


Suggested change

'Name' => 'FreePBX firmeware file upload',

'Name' => 'FreePBX firmware file upload',

jvoisin · 2026-01-07T01:18:25Z

modules/auxiliary/gather/freepbx_custom_extension_injection.rb

+        info,
+        'Name' => 'FreePBX Custom Extension SQL Injection',
+        'Description' => %q{
+          FreePBX versions prior to 16.0.44 and 17.0.23 are vulnerable to multiple CVEs, specifically CVE-2025-66039 and CVE-2025-61675, in the context of this module. The former represents an authentication bypass: when FreePBX uses Webserver Authorization Mode (an option the admin can enable), it allows an attacker to authenticate as any user. The latter CVE describes multiple SQL injections; this module exploits the SQL injection in the custom extension component. The module chains these vulnerabilities into an unauthenticated SQL injection attack that creates a new fake user and effectively grants an attacker access to the administration.


Suggested change

FreePBX versions prior to 16.0.44 and 17.0.23 are vulnerable to multiple CVEs, specifically CVE-2025-66039 and CVE-2025-61675, in the context of this module. The former represents an authentication bypass: when FreePBX uses Webserver Authorization Mode (an option the admin can enable), it allows an attacker to authenticate as any user. The latter CVE describes multiple SQL injections; this module exploits the SQL injection in the custom extension component. The module chains these vulnerabilities into an unauthenticated SQL injection attack that creates a new fake user and effectively grants an attacker access to the administration.

FreePBX versions prior to 16.0.44 and 17.0.23 are vulnerable to multiple CVEs, specifically CVE-2025-66039 and CVE-2025-61675, in the context of this module. The former represents an authentication bypass: when FreePBX uses Webserver Authorization Mode (an option the admin can enable), it allows an attacker to authenticate as any user. The latter CVE describes multiple SQL injections; this module exploits the SQL injection in the custom extension component. The module chains these vulnerabilities into an unauthenticated SQL injection attack that creates a new administrative user.

jvoisin · 2026-01-07T01:18:52Z

modules/auxiliary/gather/freepbx_custom_extension_injection.rb

+      )
+    )
+    register_options([
+      OptString.new('USERNAME', [true, 'The valid FreePBX user', 'admin']),


Suggested change

OptString.new('USERNAME', [true, 'The valid FreePBX user', 'admin']),

OptString.new('USERNAME', [true, 'A valid FreePBX user', 'admin']),

jvoisin · 2026-01-09T01:00:35Z

documentation/modules/auxiliary/gather/freepbx_custom_extension_injection.md

+authenticate as any user. The latter CVE describes multiple SQL injections; this module exploits the
+SQL injection in the custom extension component.
+The module chains these vulnerabilities into an unauthenticated SQL injection attack that creates a
+new fake user and effectively grants an attacker access to the administration.


Suggested change

new fake user and effectively grants an attacker access to the administration.

new administrative user.

jvoisin · 2026-01-09T01:01:22Z

documentation/modules/auxiliary/gather/freepbx_custom_extension_injection.md

+### USERNAME
+
+Performing authentication bypass requires the username of an existing user.
+This username is used in the Authorization header along with a random password.


Suggested change

This username is used in the Authorization header along with a random password.

This line is confusing and necessary in my opinion.

jvoisin · 2026-01-09T01:02:37Z

documentation/modules/auxiliary/gather/freepbx_custom_extension_injection.md

+### FAKE_USERNAME
+
+Username for fake injected user.
+
+### FAKE_PASSWORD
+
+Password for fake injected user.


A quick git grep shows that NEW_USER or/and NEW_USERNAME are the prefered nomenclature.

There is nothing "fake" about the new user.

jvoisin · 2026-01-09T01:21:27Z

modules/exploits/unix/http/freepbx_custom_extension_rce.rb

+  def exploit
+    @job_name = Rex::Text.rand_text_alpha(4..7)
+
+    rce_payload = 'INSERT INTO cron_jobs (modulename,jobname,command,class,schedule,max_runtime,enabled,execution_order)'


What if there is already a cronjob with the random name?

jvoisin · 2026-01-09T01:22:05Z

modules/exploits/unix/http/freepbx_firmware_file_upload.rb

@@ -0,0 +1,140 @@
+##


What's the point/advantage of this module compared to the cron-based one? Couldn't' the two be merged?

jvoisin · 2026-01-09T01:22:38Z

modules/exploits/unix/http/freepbx_firmware_file_upload.rb

+
+    register_options(
+      [
+        OptString.new('USERNAME', [true, 'The valid FreePBX user', 'admin']),


Suggested change

OptString.new('USERNAME', [true, 'The valid FreePBX user', 'admin']),

OptString.new('USERNAME', [true, 'A valid FreePBX user', 'admin']),

jvoisin · 2026-01-09T01:25:02Z

modules/exploits/unix/http/freepbx_firmware_file_upload.rb

+    form_data.add_part(SecureRandom.uuid, nil, nil, 'form-data; name="dzuuid"')
+    form_data.add_part('0', nil, nil, 'form-data; name="dzchunkindex"')
+    form_data.add_part(payload.encoded.length.to_s, nil, nil, 'form-data; name="dztotalfilesize"')
+    form_data.add_part('2000000', nil, nil, 'form-data; name="dzchunksize"')
+    form_data.add_part('1', nil, nil, 'form-data; name="dztotalchunkcount"')
+    form_data.add_part('0', nil, nil, 'form-data; name="dzchunkbyteoffset"')
+    form_data.add_part("../../../var/www/html/#{@target_dir}", nil, nil, 'form-data; name="fwbrand"')
+    form_data.add_part('1', nil, nil, 'form-data; name="fwmodel"')
+    form_data.add_part('1', nil, nil, 'form-data; name="fwversion"')
+    form_data.add_part(payload.encoded, 'application/octet-stream', nil, %(form-data; name="file"; filename="#{@target_payload}"))


Can the values be randomized a bit?

jvoisin · 2026-01-09T01:28:02Z

modules/exploits/unix/http/freepbx_firmware_file_upload.rb

+    form_data.add_part('2000000', nil, nil, 'form-data; name="dzchunksize"')
+    form_data.add_part('1', nil, nil, 'form-data; name="dztotalchunkcount"')
+    form_data.add_part('0', nil, nil, 'form-data; name="dzchunkbyteoffset"')
+    form_data.add_part("../../../var/www/html/#{@target_dir}", nil, nil, 'form-data; name="fwbrand"')


Is FreePBX always installed in /var/www/?

Modules init

f769a54

msutovsky-r7 added module needs-docs labels Jan 5, 2026

Chocapikk reviewed Jan 5, 2026

View reviewed changes

msutovsky-r7 added 4 commits January 6, 2026 12:57

Adds check methods, docs init

820d513

Adds Module Notes for firmware upload rce module

df71633

Adds descriptions

d046fa2

Updates documentation

ffb9335

msutovsky-r7 added docs and removed needs-docs labels Jan 6, 2026

msutovsky-r7 added 4 commits January 6, 2026 15:41

Updates descriptions

9c15608

Removes non-ascii character from description

bdcbe17

Fixes the auxiliary module notes

f885a66

Fixes typo in documentation

ea0573e

msutovsky-r7 changed the title ~~WIP: Adds modules for multiple CVEs for FreePBX (CVE-2025-61675, CVE-2025-61678, CVE-2025-66039)~~ Adds modules for multiple CVEs for FreePBX (CVE-2025-61675, CVE-2025-61678, CVE-2025-66039) Jan 7, 2026

msutovsky-r7 added 3 commits January 7, 2026 12:44

Msftidy documentation

a6284ca

Add directory cleanup

596c8a7

Updates documentation

cb85d4f

msutovsky-r7 marked this pull request as ready for review January 8, 2026 07:26

jvoisin reviewed Jan 9, 2026

View reviewed changes

	'Name' => 'FreePB endpoint SQLi to RCE',
	'Name' => 'FreePBX endpoint SQLi to RCE',

	'Name' => 'FreePBX firmeware file upload',
	'Name' => 'FreePBX firmware file upload',

	OptString.new('USERNAME', [true, 'The valid FreePBX user', 'admin']),
	OptString.new('USERNAME', [true, 'A valid FreePBX user', 'admin']),

	new fake user and effectively grants an attacker access to the administration.
	new administrative user.

Adds modules for multiple CVEs for FreePBX (CVE-2025-61675, CVE-2025-61678, CVE-2025-66039) #20846

Are you sure you want to change the base?

Adds modules for multiple CVEs for FreePBX (CVE-2025-61675, CVE-2025-61678, CVE-2025-66039) #20846

Uh oh!

Conversation

msutovsky-r7 commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jan 5, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

msutovsky-r7 commented Jan 5, 2026 •

edited

Loading