Description

A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator. The /admin/ajax.php dispatcher in amp_conf/htdocs/admin/libraries/BMO/Ajax.class.php does not implement CSRF tokens; its only protection is a Referer header check that is bypassed when the request is sent without a Referer header or from a same-site context, enabling attackers to trigger admin operations by luring an administrator to a malicious page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-10T11:17:30.660Z",
  "pubdate": "2026-08-10T11:17:30.660Z",
  "executiveSummary": "A cross-site request forgery vulnerability exists within the FreePBX Framework 17.0, specifically affecting the administrative dispatcher mechanism. This security flaw allows an unauthenticated remote attacker to execute arbitrary administrative actions on behalf of a legitimately authenticated administrator without their knowledge or consent.\nThe core vulnerability stems from insufficient request validation within the application logic, where critical state-changing requests rely solely on an easily bypassed Referer header check rather than robust anti-CSRF tokens. Consequently, if an authenticated administrator visits a malicious web page controlled by an attacker, the browser automatically includes session cookies while dispatching requests to the vulnerable endpoint.\nThe risk implications are severe, as successful exploitation grants the attacker full administrative control over the affected FreePBX deployment. This enables the execution of privileged system operations, potential remote code execution pathways, and total compromise of the telephony infrastructure. The attack requires no prior authentication for the malicious actor, though it relies on social engineering or luring an authenticated administrator to interact with the malicious context to trigger the payload.",
  "technicalDetails": "The vulnerability resides in the FreePBX Framework 17.0 application logic, specifically within the /admin/ajax.php dispatcher located at amp_conf/htdocs/admin/libraries/BMO/Ajax.class.php. This component processes asynchronous administrative requests but fails to implement cryptographic anti-CSRF tokens to validate the origin and intent of incoming state-changing HTTP requests.\nThe root cause of the flaw is an inadequate access control mechanism that attempts to restrict requests by solely inspecting the HTTP Referer header. This validation is fundamentally flawed because it can be entirely bypassed when an HTTP request is transmitted without a Referer header or when requests originate from a same-site context manipulated by the attacker. Because the application trusts these requests without enforcing session-specific synchronization tokens, it processes them as legitimate user actions.\nThe attack flow proceeds as follows: 1) An unauthenticated remote attacker constructs a malicious web page containing automated JavaScript or HTML form submissions targeting the vulnerable /admin/ajax.php endpoint on the target FreePBX server. 2) The attacker lures a legitimately authenticated FreePBX administrator into visiting the malicious page via social engineering or drive-by vectors. 3) The victim's browser automatically appends valid session identifiers, such as HTTP cookies or authentication tokens, to the cross-site request destined for the FreePBX server. 4) The request is crafted to omit or spoof the Referer header, successfully bypassing the weak validation check implemented in Ajax.class.php. 5) The FreePBX framework processes the incoming payload and executes the requested administrative operations under the security context of the victimized administrator.\nNetwork exposure is fully remote over HTTP/HTTPS, requiring no prior authentication or privileges for the external attacker, while implicitly requiring an authenticated administrator session on the victim's end for successful exploitation. The post-exploitation impact includes unauthorized modification of system configurations, creation of backdoor administrator accounts, manipulation of telephony routes, and complete administrative takeover of the underlying FreePBX environment."
}