Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient; stock directory users without password material can also remove that barrier in affected configurations. The flaw permits configuration and credential disclosure, arbitrary call control, and command execution, and exploitation has been observed in the wild. This issue is fixed in version 1.11.3.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-05T20:17:44.790Z",
  "pubdate": "2026-11-05T20:17:44.790Z",
  "executiveSummary": "FreeSWITCH versions prior to 1.11.3 contain a critical vulnerability involving improper input validation within the SIP MESSAGE handling logic. The flaw allows authenticated remote attackers to execute arbitrary system-level commands with the privileges of the FreeSWITCH daemon process.\nThe vulnerability resides in the function sofia_presence_handle_sip_i_message(), where the 'To' user field of an inbound SIP MESSAGE is processed without sufficient sanitization. By manipulating the 'To' header, an attacker can invoke the 'api' chat protocol selector, which bridges the input directly to the switch_api_execute() function.\nThis facilitates a command injection scenario, enabling attackers to gain complete control over the host environment. The impact includes, but is not limited to, unauthorized credential disclosure, arbitrary manipulation of call control functions, and full operating system command execution.\nExploitation has been confirmed in the wild, posing a severe security risk to deployments where the default internal or external SIP profiles are enabled. The attack requires access to the system via an authenticated account, although certain misconfigurations may allow unauthenticated users to bypass security barriers, significantly increasing the attack surface.",
  "technicalDetails": "The vulnerability originates in the sofia_presence_handle_sip_i_message() function, which handles incoming SIP MESSAGE requests. This function implements a logic branch that parses the 'To' user portion of the SIP URI by splitting the string upon encountering a plus sign (+).\nThe logic erroneously treats the substring to the left of the plus sign as a chat protocol selector. A critical flaw exists where the input can be crafted to trigger the 'api' protocol handler. When 'api' is selected, the subsystem routes the remaining contents of the message directly to the internal switch_api_execute() function without further verification or sanitization.\nThe switch_api_execute() function is designed to process internal FreeSWITCH API commands. Because this function interfaces with OS-level command sinks, it allows the execution of system commands with the same user privileges as the FreeSWITCH daemon process. An attacker can supply arbitrary shell commands, which are then executed by the underlying operating system.\nThe attack flow proceeds as follows: First, the attacker identifies a reachable SIP endpoint. Second, they construct a crafted SIP MESSAGE packet where the 'To' header is structured to contain 'api' followed by the desired payload. Third, upon receipt, FreeSWITCH processes the 'To' user, parses the protocol as 'api', and passes the payload to the command execution engine.\nThe vulnerability affects FreeSWITCH versions prior to 1.11.3. While exploitation typically requires an authenticated profile account, the risk is elevated because the default configuration enables inbound chat on internal and external profiles. Furthermore, instances with weak directory user configurations, specifically those lacking password material, may permit unauthenticated exploitation by removing the authentication barrier.\nPost-exploitation impact is catastrophic, as the attacker achieves Remote Code Execution (RCE). The adversary can extract sensitive configuration files, dump database credentials, manipulate real-time telecom traffic (call control), or pivot into the internal network using the compromised daemon's privileges. The availability of this vector as a direct-to-shell command sink makes this a high-severity entry point for persistent threats."
}