CVE-2019-19006 Google Chronicle · YARA-L

Detect Sangoma FreePBX Remote Admin Authentication Bypass (CVE-2019-19006) in Google Chronicle

CVE-2019-19006 is an improper authentication vulnerability (CWE-287) in Sangoma FreePBX that allows remote unauthenticated attackers to bypass administrative authentication controls. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation grants attackers full administrative access to the FreePBX VoIP management interface, enabling call interception, configuration tampering, toll fraud, and potential lateral movement into the broader network.

MITRE ATT&CK

Tactic
Initial Access Privilege Escalation Credential Access

YARA-L Detection Query

Google Chronicle (YARA-L)
yaral 
rule freepbx_auth_bypass_cve_2019_19006 {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects potential exploitation of CVE-2019-19006 Sangoma FreePBX improper authentication bypass"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2019-19006"
    yara_version = "YL2.0"
    rule_version = "1.0"

  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.response_code = 200 or $e.network.http.response_code = 302
    (
      re.regex($e.network.http.request_url, `/admin/config\.php`) or
      re.regex($e.network.http.request_url, `/admin/ajax\.php`) or
      re.regex($e.network.http.request_url, `/admin/page\.php`) or
      re.regex($e.network.http.request_url, `/admin/modules/`)
    )
    not net.ip_in_range_cidr($e.principal.ip, "10.0.0.0/8")
    not net.ip_in_range_cidr($e.principal.ip, "172.16.0.0/12")
    not net.ip_in_range_cidr($e.principal.ip, "192.168.0.0/16")
    $src_ip = $e.principal.ip

  match:
    $src_ip over 10m

  condition:
    #e >= 1
}
critical severity medium confidence

Chronicle YARA-L rule detecting external source IPs successfully accessing FreePBX administrative endpoints, which may indicate exploitation of the authentication bypass vulnerability CVE-2019-19006.

Data Sources

Chronicle UDM HTTP eventsNetwork proxy logs ingested into ChronicleWeb server logs via Chronicle forwarder

Required Tables

UDM events with NETWORK_HTTP type

False Positives & Tuning

  • Administrators connecting from external IPs without VPN
  • Cloud-based management platforms with public IP addresses
  • Authorized third-party FreePBX support vendors accessing admin panel remotely
  • NAT environments where multiple users share a single external IP

Other platforms for CVE-2019-19006

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Unauthenticated FreePBX Admin Panel Access Probe

    Expected signal: Web server access log entry showing GET /admin/config.php returning HTTP 200 with no prior authenticated session POST to login endpoint. No Set-Cookie with valid session token in prior requests.

  2. Test 2FreePBX Admin AJAX Endpoint Enumeration Without Auth

    Expected signal: Multiple HTTP GET requests to /admin/ajax.php with varying query parameters from the same source IP within a short time window. Response codes of 200 indicate the endpoints are reachable without authentication.

  3. Test 3FreePBX Unauthorized Admin Account Creation Simulation

    Expected signal: HTTP POST to /admin/config.php with user creation parameters visible in request body. If exploitation succeeds, FreePBX audit logs should show a new user account creation without a corresponding prior admin login. MySQL binary logs capture INSERT into user tables.

  4. Test 4Network Scan for Exposed FreePBX Admin Interfaces

    Expected signal: Network scan traffic visible in IDS/IPS logs and firewall flow logs. HTTP probes to /admin/ path generate web server access log entries. Port scan signatures may trigger on receiving host if endpoint detection is installed.

Last updated: 2026-06-19 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the source IP(s) making requests to FreePBX admin paths and determine if they are internal, VPN egress, or fully external/untrusted addresses.
  2. Check HTTP response codes and session cookies returned — a 200 response to /admin/config.php or /admin/ajax.php without a valid authenticated session cookie strongly indicates successful authentication bypass.
  3. Correlate web server access logs with FreePBX audit logs (/var/log/asterisk/ or FreePBX admin log module) to determine if configuration changes were made following the suspicious request.
  4. Enumerate any outbound calls, SIP registrations, or trunk modifications made after the suspicious admin access window to assess toll fraud or call interception impact.
  5. Check for new admin user accounts or password changes made via the admin panel during or after the suspicious access period.

Containment

  1. Immediately block the offending source IP(s) at the perimeter firewall and any WAF rules in front of the FreePBX instance. Apply emergency ACLs to restrict /admin/ paths to known-good management IP ranges only.
  2. If exploitation is confirmed, take the FreePBX admin interface offline or restrict it to localhost-only access until the patch is applied. Use iptables or firewall rules to drop inbound traffic on port 80/443 from all untrusted sources as an emergency measure.
  3. Rotate all FreePBX admin credentials, SIP trunk passwords, and any API keys stored within FreePBX. Revoke all active sessions by clearing session storage.
  4. Preserve a forensic snapshot of the FreePBX system state before applying patches — capture running process list, open network connections, scheduled jobs, and modified config files.

Evidence Collection

  1. Collect complete web server access logs (Apache/Nginx) for the period covering the suspicious activity, including all requests to /admin/ paths, response sizes, and timing data.
  2. Extract FreePBX database contents (MySQL/MariaDB) for the admin_users, extensions, trunks, and outbound_routes tables to identify unauthorized configuration changes introduced by the attacker.
  3. Capture current network connections (netstat -antp / ss -antp) and any active SIP sessions to identify potential persistent attacker footholds or ongoing toll fraud calls.
  4. Hash and preserve all files under /etc/asterisk/, /var/www/html/admin/, and /var/spool/asterisk/ as these may contain attacker-planted backdoors or modified configuration.

Escalation Criteria

  • !Escalate immediately if any outbound call records show calls to international premium rate numbers, high-volume domestic calls, or unusual geographic destinations following the authentication bypass — this indicates active toll fraud with direct financial impact.
  • !Escalate to incident response if FreePBX admin logs show creation of new admin accounts, modification of SIP trunks, or changes to dial plan routing rules, as these indicate the attacker achieved full administrative control and may have established persistence.
  • !Escalate if the compromised FreePBX system has network connectivity to internal corporate systems beyond the VoIP VLAN, as lateral movement risk is elevated.

Investigation Guide

Related Techniques

[object Object][object Object][object Object]

Forensic Artifacts

  • >Web server access logs showing successful HTTP 200/302 responses to /admin/config.php or /admin/ajax.php without preceding authenticated session establishment
  • >FreePBX audit log entries (/admin/modules/logfiles/) showing configuration changes without a corresponding authenticated admin login event
  • >MySQL/MariaDB binary logs showing INSERT or UPDATE statements to FreePBX admin tables during the exploitation window
  • >Asterisk CDR (Call Detail Records) in /var/spool/asterisk/monitor/ or the FreePBX CDR module showing anomalous outbound calls following the breach
  • >Modified or newly created files under /etc/asterisk/extensions_custom.conf or /etc/asterisk/sip_custom.conf indicating dial plan tampering

Tuning Guidance

Reduce false positives by maintaining an allowlist of known administrator IP ranges (corporate egress IPs, VPN concentrator IPs) and excluding them from alerting. Set the request count threshold based on your organization's normal admin access frequency — for environments with a single admin, even 1 external request to admin paths should alert. Correlate with authentication events from FreePBX logs: if a 200 response to an admin path is NOT preceded by a POST to a login endpoint within the same session, confidence in exploitation increases significantly. Consider adding user-agent analysis — automated exploit tools often use non-browser user agents or default curl/python-requests strings.

Hunting Queries

Hunt for off-hours access to FreePBX admin endpoints that could indicate unauthorized access by external threat actors exploiting CVE-2019-19006 outside normal business hours.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestURL has '/admin/'
| where EventOutcome in ('200', '302')
| extend Hour = datetime_part('hour', TimeGenerated)
| where Hour !between (8 .. 18)
| summarize OffHoursAdminAccess = count() by SourceIP, RequestURL, bin(TimeGenerated, 1h)
| where OffHoursAdminAccess >= 1
| order by OffHoursAdminAccess desc
Hunting — SPL
spl 
index=web sourcetype=access_combined uri_path="/admin/*" status=200
| eval hour=strftime(_time, "%H")
| where hour < 8 OR hour > 18
| stats count as off_hours_requests, values(uri_path) as paths by clientip, date_mday, date_month
| where off_hours_requests >= 1
| sort -off_hours_requests

Hunt for source IPs accessing a high diversity of FreePBX admin paths within a short window, indicative of post-authentication-bypass enumeration or automated exploitation tooling.

Hunting — KQL
kql 
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where RequestURL has '/admin/'
| where EventOutcome == '200'
| summarize UniqueAdminPaths = dcount(RequestURL), RequestCount = count() by SourceIP, bin(TimeGenerated, 1h)
| where UniqueAdminPaths >= 5
| order by UniqueAdminPaths desc
Hunting — SPL
spl 
index=web sourcetype=access_combined uri_path="/admin/*" status=200
| bin _time span=1h
| stats dc(uri_path) as unique_paths, count as total_requests by clientip, _time
| where unique_paths >= 5
| sort -unique_paths

Atomic Red Team Tests

Test 1 Unauthenticated FreePBX Admin Panel Access Probe
linux

Simulates an attacker probing the FreePBX admin panel to test for the CVE-2019-19006 authentication bypass by directly requesting the admin configuration page without providing valid session credentials.

Command

bash 
curl -v -L --max-redirs 5 -c /tmp/freepbx_cookies.txt -b /tmp/freepbx_cookies.txt -A 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' 'http://<TARGET_IP>/admin/config.php' 2>&1 | grep -E 'HTTP/|Location:|Set-Cookie:|<title>'

Cleanup

bash 
rm -f /tmp/freepbx_cookies.txt

Expected Telemetry

Web server access log entry showing GET /admin/config.php returning HTTP 200 with no prior authenticated session POST to login endpoint. No Set-Cookie with valid session token in prior requests.

Expected Detection

Detection rule triggers on successful HTTP 200 response to /admin/config.php from the test source IP. Alert should fire in the SIEM within the configured time window.

Test 2 FreePBX Admin AJAX Endpoint Enumeration Without Auth
linux

Simulates post-bypass enumeration of FreePBX admin AJAX endpoints that would allow an attacker to extract configuration data such as SIP trunk credentials and extension lists.

Command

bash 
for endpoint in 'ajax.php?module=core&command=getExtensions' 'ajax.php?module=trunks&command=getTrunks' 'ajax.php?module=outbound_routes&command=getRoutes'; do echo "=== Testing: $endpoint ==="; curl -s -o /dev/null -w '%{http_code} %{url_effective}\n' -A 'Mozilla/5.0' "http://<TARGET_IP>/admin/$endpoint"; sleep 1; done

Cleanup

bash 
No cleanup required — read-only probe requests.

Expected Telemetry

Multiple HTTP GET requests to /admin/ajax.php with varying query parameters from the same source IP within a short time window. Response codes of 200 indicate the endpoints are reachable without authentication.

Expected Detection

Detection rules trigger on rapid sequential successful requests to /admin/ajax.php from a single source IP. Aggregation-based rules should fire when request_count exceeds threshold within the time window.

Test 3 FreePBX Unauthorized Admin Account Creation Simulation
linux

Simulates an attacker who has bypassed authentication attempting to create a new admin user account via the FreePBX admin interface to establish persistent administrative access.

Command

bash 
curl -v -X POST 'http://<TARGET_IP>/admin/config.php' -H 'Content-Type: application/x-www-form-urlencoded' -A 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' --data 'display=userman&action=addUser&username=testbackdoor&password=TestP4ssw0rd!&[email protected]' -c /tmp/freepbx_session.txt -b /tmp/freepbx_session.txt 2>&1

Cleanup

bash 
rm -f /tmp/freepbx_session.txt; # In lab: log into FreePBX admin and delete the 'testbackdoor' user if created successfully

Expected Telemetry

HTTP POST to /admin/config.php with user creation parameters visible in request body. If exploitation succeeds, FreePBX audit logs should show a new user account creation without a corresponding prior admin login. MySQL binary logs capture INSERT into user tables.

Expected Detection

Detection fires on POST request to /admin/config.php from unauthenticated or externally-sourced session. If integrated with FreePBX audit log ingestion, a secondary alert may fire on user_created event without preceding authenticated_login event from the same session ID.

Test 4 Network Scan for Exposed FreePBX Admin Interfaces
linux

Simulates attacker reconnaissance to discover internet-exposed FreePBX admin interfaces vulnerable to CVE-2019-19006 by probing common VoIP management ports and paths.

Command

bash 
nmap -sV -p 80,443,8080,8443 --script http-title,http-headers <TARGET_SUBNET> 2>/dev/null | grep -A3 -B3 'FreePBX\|Asterisk\|PBX'; echo '---'; curl -sk 'https://<TARGET_IP>/admin/' -o /dev/null -w 'HTTPS Admin: %{http_code}\n'; curl -sk 'http://<TARGET_IP>/admin/' -o /dev/null -w 'HTTP Admin: %{http_code}\n'

Cleanup

bash 
No cleanup required — passive reconnaissance only.

Expected Telemetry

Network scan traffic visible in IDS/IPS logs and firewall flow logs. HTTP probes to /admin/ path generate web server access log entries. Port scan signatures may trigger on receiving host if endpoint detection is installed.

Expected Detection

Network-layer detection for port scan activity from the test source IP. Application-layer detection for HTTP probe to /admin/ path. Combination of both events from same source IP within a short window increases confidence of coordinated reconnaissance.

Related Detections

Tactic Hubs

TA0001Initial AccessTA0004Privilege EscalationTA0006Credential Access

Related Techniques

T1190Exploit Public-Facing ApplicationT1078Valid AccountsT1565Data Manipulation

Same Tactic: Initial Access

Popular Detections