Description

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, sofia_handle_sip_i_refer() placed raw Refer-To URI parameters and headers inside a sip_invite_params channel-variable block passed to switch_ivr_originate(). The originate parser treated a comma in the attacker-controlled value as a variable separator, allowing an authenticated caller on a bridged call to inject arbitrary variables into a newly originated leg. An injected execute_on_originate value could invoke the system dialplan application before answer and execute operating-system commands with the FreeSWITCH process privileges. SIP REFER is enabled by default, and the sender needs only a registered account and a call that takes the off-box transfer path, not administrative or Event Socket access. This issue is fixed in version 1.11.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-11-05T20:17:45.900Z",
  "pubdate": "2026-11-05T20:17:45.900Z",
  "executiveSummary": "FreeSWITCH versions prior to 1.11.2 are susceptible to a critical variable injection vulnerability within the SIP processing engine. The flaw resides in the handling of SIP REFER requests, where insufficient sanitization of the Refer-To URI parameters allows for the improper injection of arbitrary channel variables.\nBy manipulating the sip_invite_params channel-variable block, an authenticated attacker can influence the state of new call legs originated via switch_ivr_originate(). The primary impact is the potential for Remote Code Execution (RCE) with the privileges of the FreeSWITCH process, as attackers can inject malicious execute_on_originate strings to trigger arbitrary system-level commands.\nThis vulnerability is particularly dangerous because SIP REFER is enabled by default. Exploitation does not require administrative privileges or access to the Event Socket; it only necessitates a registered user account and the ability to initiate a call that utilizes an off-box transfer path. Due to the ability to escape the intended call context and execute operating-system commands, this vulnerability poses a severe risk to the confidentiality, integrity, and availability of the host infrastructure.",
  "technicalDetails": "The vulnerability is located in the sofia_handle_sip_i_refer() function, which is responsible for processing SIP REFER requests within the Sofia-SIP module. The root cause of the issue is the insecure handling of raw Refer-To URI parameters and headers.\nWhen a REFER request is received, the function improperly incorporates attacker-controlled input directly into the sip_invite_params channel-variable block. This block is subsequently passed to the switch_ivr_originate() function, which acts as the core engine for creating new call legs in FreeSWITCH.\nThe originate parser in switch_ivr_originate() is designed to interpret strings of variables separated by commas. Because the input from the SIP REFER request is not properly sanitized or escaped, an attacker can embed a comma character into their crafted Refer-To header. This character acts as a delimiter, allowing the attacker to terminate the intended variable assignment and inject additional, arbitrary channel variables into the new call leg.\nA typical attack flow proceeds as follows: First, the attacker initiates a call as an authenticated user. Second, the attacker sends a crafted SIP REFER request containing a malicious Refer-To URI. This URI includes a payload where the comma is used to inject an execute_on_originate variable. This specific variable is a powerful FreeSWITCH mechanism that triggers the execution of a designated dialplan application or command when a specific event (such as call origination) occurs.\nBy setting the execute_on_originate variable to trigger a system dialplan application, the attacker can force the FreeSWITCH process to execute arbitrary operating-system commands. Since FreeSWITCH often runs with elevated service account privileges, this leads to full system compromise.\nThe exploitation process does not require specialized network access beyond that of a registered SIP client. Because the transfer path is handled via the off-box transfer logic, the attacker can orchestrate this flow during an existing bridged call. The vulnerability was successfully mitigated in version 1.11.2 by implementing rigorous input sanitization and ensuring that channel variables originating from external SIP headers are treated as untrusted and properly delimited to prevent injection into the internal configuration parser."
}