Description Preview
A vulnerability has been identified in 3CX Phone System through versions released before March 17, 2022. The system stores user passwords in cleartext format within its database, which violates security best practices for credential storage. This vulnerability (CVE-2021-45491) is classified as CWE-312: Cleartext Storage of Sensitive Information and could potentially allow attackers who gain access to the database to directly obtain user credentials without needing to crack hashed passwords.
Overview
The 3CX Phone System, a popular VoIP PBX solution, was found to store user passwords in cleartext within its database. This practice poses significant security risks as any unauthorized access to the database would immediately compromise all user credentials. When passwords are stored in cleartext rather than using cryptographic hashing algorithms, they are directly readable if the database is compromised through SQL injection, unauthorized access, or data breaches. This vulnerability affects all versions of the 3CX Phone System released prior to March 17, 2022, and could potentially lead to account takeovers, unauthorized system access, and further system compromise.
Remediation
Organizations using affected versions of 3CX Phone System should:
- Update to the latest version of 3CX Phone System released after March 17, 2022, which implements proper password hashing.
- After updating, force all users to change their passwords to ensure they are stored using the new secure method.
- Review database access controls and implement principle of least privilege.
- Implement network segmentation to restrict access to the database server.
- Monitor for unauthorized access attempts to the database.
- Consider implementing multi-factor authentication where possible to mitigate the risk of credential compromise.
- Audit user accounts for any signs of unauthorized access that may have occurred prior to remediation.
References
- Packet Storm Security Advisory: http://packetstormsecurity.com/files/166386/3CX-Phone-System-Cleartext-Passwords.html
- 3CX Vendor Advisory: https://www.3cx.com/community/forums/posts-articles-news/
- CWE-312: Cleartext Storage of Sensitive Information: https://cwe.mitre.org/data/definitions/312.html
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
