Executive brief
Frogman, a tool used for managing Asterisk-based phone systems (PBX), contains a vulnerability that allows users with basic write permissions to take full control of the server. By sending specially crafted commands through the system's API, an attacker can bypass intended restrictions to execute arbitrary code or system commands. This could lead to a total compromise of the phone system, unauthorized access to call data, or the ability to use the server for further attacks on the corporate network.
Technical details
A code injection vulnerability exists in Frogman's fm_dialplan_apply function due to insufficient sanitization of template parameters (such as greeting, dest, and url) before they are written to the Asterisk configuration file (extensions_custom.conf). While the contextName() was sanitized, other parameters were interpolated raw, allowing a caller with PERM_WRITE privileges to use newlines and special characters to inject arbitrary Asterisk directives. This includes dangerous functions like System() and SHELL(), which grant the attacker root-equivalent shell access on the PBX host. The vulnerability is fixed in version 1.6.2 by implementing strict whitelist validation for all template parameters and a framework-level rejection of control characters.
Affected products
- mwtcmi frogman < 1.6.2
Timeline
- 2026-05-13: disclosed: Disclosed via FreePBX community forum
- 2026-05-13: patched: Version 1.6.2 released to fix the injection and an installation regression in 1.6.1
- 2026-07-16: advisory: NVD publication date