Critical Web Shell Infections Hit 900 Sangoma FreePBX Systems via Command Injection Flaw

Sangoma FreePBX Systems Compromised in Large-Scale Web Shell Attack

Security researchers have identified a widespread compromise of 900 Sangoma FreePBX instances, which have been infected with web shells through the exploitation of a post-authentication command injection vulnerability in the platform’s Endpoint Manager interface. The attacks highlight ongoing risks associated with VoIP and unified communications infrastructure.

Technical Details of the Exploit

The vulnerability, which has not been assigned a CVE ID at the time of reporting, allows threat actors to execute arbitrary commands on vulnerable FreePBX systems after authentication. The flaw resides in the Endpoint Manager module, a component used for configuring and managing VoIP endpoints. By exploiting this weakness, attackers successfully deployed web shells, granting persistent remote access to compromised systems.

Sangoma FreePBX is an open-source PBX (Private Branch Exchange) platform widely used for VoIP and unified communications. The affected systems are typically deployed in enterprise environments, making them high-value targets for threat actors seeking to establish footholds in corporate networks.

Impact and Risks

The deployment of web shells on FreePBX instances poses significant risks, including:

• Persistent remote access for threat actors, enabling further lateral movement within networks.
• Data exfiltration, including call logs, voicemail recordings, and sensitive communications.
• Potential for secondary attacks, such as ransomware deployment or VoIP fraud (e.g., toll fraud).
• Compromise of adjacent systems, particularly if FreePBX servers are integrated with other enterprise applications.

The scale of the infection—affecting 900 instances—suggests automated exploitation, likely targeting exposed or misconfigured FreePBX deployments. Organizations using Sangoma FreePBX should assume that unpatched systems are at immediate risk of compromise.

Recommendations for Security Teams

1. Immediate Patching: Apply the latest security updates from Sangoma to mitigate the command injection vulnerability. If no patch is available, consider disabling the Endpoint Manager module until a fix is released.
2. Isolation and Containment: Isolate affected FreePBX instances from the network to prevent further exploitation or lateral movement.
3. Forensic Analysis: Conduct a thorough investigation to determine the scope of compromise, including checking for web shells (e.g., .php, .jsp, or .asp files in web directories) and reviewing logs for unauthorized access.
4. Credential Rotation: Reset all credentials associated with FreePBX, including administrative accounts, SIP credentials, and database passwords.
5. Network Segmentation: Ensure FreePBX systems are segmented from other critical network assets to limit the impact of potential breaches.
6. Monitoring and Detection: Deploy intrusion detection/prevention systems (IDS/IPS) and endpoint detection and response (EDR) solutions to detect anomalous activity, such as unusual command execution or outbound connections.

Conclusion

This incident underscores the critical importance of securing VoIP and unified communications infrastructure, which is often overlooked in enterprise security strategies. Organizations using Sangoma FreePBX must prioritize patching, monitoring, and hardening to mitigate the risks posed by this and similar vulnerabilities. Security teams should treat exposed FreePBX instances as high-risk assets and implement proactive measures to prevent exploitation.