URGENT: Sangoma FreePBX Warns of Exploit, Urges Immediate Administrator Lockdown

Administrators are being urged to lockdown FreePBX systems after the Sangoma FreePBX Security Team disclosed a potential exploit affecting systems with the Administrator Control Panel exposed to the public internet, with a permanent fix still in progress.

According to The Sangoma FreePBX Security Team, the exploit could allow attackers to compromise FreePBX or PBXAct systems, and they advise limiting access to the FreePBX Administrator by using the Firewall module to restrict access to only known trusted hosts, in addition to implementing the EDGE module update for testing.

The advisory notes that deployment of the fix is expected within the next 36 hours, and provides specific commands for FreePBX v16 or v17 and for PBXAct v16 and v17 to download and install the endpoint module. Administrators should check for signs of compromise using a minimum infection detection checklist, including verifying /etc/freepbx.conf, looking for /var/www/html/.clean[.]sh, and reviewing Apache and Asterisk logs for suspicious activity, as well as examining ampusers tables for unknown accounts.

Backups from before 21 August should be preserved, systems reinstalled with updated endpoint modules and proper firewalling, credentials rotated, and call detail records reviewed for fraud indicators.