CVE-2020-7351 Fonality Trixbox CE Post-Authentication Command Injection

High 7.3 Published 1 May 2020 Updated 16 Sep 2024

Authenticated attackers can execute arbitrary OS commands on Fonality Trixbox CE, which is unsupported software.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2020-7351?

CVE-2020-7351 is a high-severity command injection vulnerability in Fonality Trixbox Community Edition, published on 1 May 2020. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. This issue affects: Fonality Trixbox Community Edition, versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected.

Weakness: CWE-78

Which versions are affected by CVE-2020-7351?

It affects 1 product.

Products include Netfortris Trixbox.

How do I fix CVE-2020-7351?

No fix has been published for CVE-2020-7351 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2020-7351 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-7351 exists.

Public exploit code: 1 Metasploit module.

Sources

Also known as GHSA-fp83-q3j6-rggc.