^{CVE-2020-7351:}OS Command Injection vulnerability in Fonality Trixbox CE allows remote command execution as "asterisk" user.

Overview

The vulnerability in Trixbox CE allows attackers to inject malicious commands through the endpoint_devicemap.php component. Since the commands execute with the permissions of the "asterisk" user, attackers can potentially gain access to sensitive system information, modify configurations, or use the compromised system as a launching point for further attacks within the network. This vulnerability has been documented in public exploit repositories and has been incorporated into the Metasploit Framework, indicating its severity and the availability of exploitation tools. The fact that Trixbox CE has been unsupported since 2012 means that no official patches will be released, leaving systems permanently vulnerable unless migrated to supported alternatives.

Remediation

As Fonality Trixbox Community Edition has been unsupported since 2012, there are no official patches available for this vulnerability. Organizations still using Trixbox CE should consider the following remediation steps:

1. Migrate to a supported VoIP/PBX solution as soon as possible.
2. If immediate migration is not possible, implement network-level controls to restrict access to the vulnerable component:
   • Use firewalls to limit access to the Trixbox web interface
   • Implement network segmentation to isolate the Trixbox system
   • Consider deploying a web application firewall (WAF) to filter malicious requests
3. Regularly monitor system logs for suspicious activities related to the "asterisk" user
4. Ensure the "asterisk" user has minimal privileges on the system to reduce the impact of exploitation

References

1. Packet Storm Security - TrixBox CE 2.8.0.4 Command Execution: http://packetstormsecurity.com/files/157565/TrixBox-CE-2.8.0.4-Command-Execution.html

2. Metasploit Framework Pull Request (includes exploit code): https://github.com/rapid7/metasploit-framework/pull/13353

3. Common Weakness Enumeration (CWE-78): OS Command Injection https://cwe.mitre.org/data/definitions/78.html