Detect Sangoma FreePBX Remote Admin Authentication Bypass (CVE-2019-19006) in Microsoft Sentinel
CVE-2019-19006 is an improper authentication vulnerability (CWE-287) in Sangoma FreePBX that allows remote unauthenticated attackers to bypass administrative authentication controls. This vulnerability is listed on CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Successful exploitation grants attackers full administrative access to the FreePBX VoIP management interface, enabling call interception, configuration tampering, toll fraud, and potential lateral movement into the broader network.
MITRE ATT&CK
KQL Detection Query
let FreePBXAdminPaths = dynamic(['/admin/config.php', '/admin/ajax.php', '/admin/modules/', '/admin/page.php']);
let SuspiciousStatusCodes = dynamic([200, 302]);
union CommonSecurityLog, W3CIISLog, AzureDiagnostics
| where TimeGenerated >= ago(24h)
| where isnotempty(RequestURL) or isnotempty(csUriStem)
| extend UrlPath = coalesce(RequestURL, csUriStem, '')
| where UrlPath has_any (FreePBXAdminPaths)
| extend StatusCodeInt = toint(coalesce(tostring(EventOutcome), tostring(scStatus), ''))
| where StatusCodeInt in (SuspiciousStatusCodes)
| extend SourceIPAddr = coalesce(SourceIP, cIp, CallerIpAddress)
| extend UserAgent = coalesce(RequestClientApplication, csUserAgent, '')
| summarize
RequestCount = count(),
DistinctPaths = make_set(UrlPath, 50),
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated)
by SourceIPAddr, UserAgent, bin(TimeGenerated, 5m)
| where RequestCount >= 1
| extend AlertSeverity = iff(RequestCount > 10, 'High', 'Medium')
| project TimeGenerated, SourceIPAddr, UserAgent, RequestCount, DistinctPaths, FirstSeen, LastSeen, AlertSeverityDetects HTTP requests targeting FreePBX administrative endpoints that may indicate authentication bypass exploitation. Looks for successful responses to admin panel paths from potentially unauthenticated sessions.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate administrators accessing the FreePBX admin panel from known IP ranges
- Automated health monitoring tools probing admin endpoints
- Security scanners or vulnerability assessment tools in authorized engagements
- Load balancers or reverse proxies forwarding legitimate admin traffic
Other platforms for CVE-2019-19006
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Unauthenticated FreePBX Admin Panel Access Probe
Expected signal: Web server access log entry showing GET /admin/config.php returning HTTP 200 with no prior authenticated session POST to login endpoint. No Set-Cookie with valid session token in prior requests.
- Test 2FreePBX Admin AJAX Endpoint Enumeration Without Auth
Expected signal: Multiple HTTP GET requests to /admin/ajax.php with varying query parameters from the same source IP within a short time window. Response codes of 200 indicate the endpoints are reachable without authentication.
- Test 3FreePBX Unauthorized Admin Account Creation Simulation
Expected signal: HTTP POST to /admin/config.php with user creation parameters visible in request body. If exploitation succeeds, FreePBX audit logs should show a new user account creation without a corresponding prior admin login. MySQL binary logs capture INSERT into user tables.
- Test 4Network Scan for Exposed FreePBX Admin Interfaces
Expected signal: Network scan traffic visible in IDS/IPS logs and firewall flow logs. HTTP probes to /admin/ path generate web server access log entries. Port scan signatures may trigger on receiving host if endpoint detection is installed.
Response Playbook
Triage
- Identify the source IP(s) making requests to FreePBX admin paths and determine if they are internal, VPN egress, or fully external/untrusted addresses.
- Check HTTP response codes and session cookies returned — a 200 response to /admin/config.php or /admin/ajax.php without a valid authenticated session cookie strongly indicates successful authentication bypass.
- Correlate web server access logs with FreePBX audit logs (/var/log/asterisk/ or FreePBX admin log module) to determine if configuration changes were made following the suspicious request.
- Enumerate any outbound calls, SIP registrations, or trunk modifications made after the suspicious admin access window to assess toll fraud or call interception impact.
- Check for new admin user accounts or password changes made via the admin panel during or after the suspicious access period.
Containment
- Immediately block the offending source IP(s) at the perimeter firewall and any WAF rules in front of the FreePBX instance. Apply emergency ACLs to restrict /admin/ paths to known-good management IP ranges only.
- If exploitation is confirmed, take the FreePBX admin interface offline or restrict it to localhost-only access until the patch is applied. Use iptables or firewall rules to drop inbound traffic on port 80/443 from all untrusted sources as an emergency measure.
- Rotate all FreePBX admin credentials, SIP trunk passwords, and any API keys stored within FreePBX. Revoke all active sessions by clearing session storage.
- Preserve a forensic snapshot of the FreePBX system state before applying patches — capture running process list, open network connections, scheduled jobs, and modified config files.
Evidence Collection
- Collect complete web server access logs (Apache/Nginx) for the period covering the suspicious activity, including all requests to /admin/ paths, response sizes, and timing data.
- Extract FreePBX database contents (MySQL/MariaDB) for the admin_users, extensions, trunks, and outbound_routes tables to identify unauthorized configuration changes introduced by the attacker.
- Capture current network connections (netstat -antp / ss -antp) and any active SIP sessions to identify potential persistent attacker footholds or ongoing toll fraud calls.
- Hash and preserve all files under /etc/asterisk/, /var/www/html/admin/, and /var/spool/asterisk/ as these may contain attacker-planted backdoors or modified configuration.
Escalation Criteria
- !Escalate immediately if any outbound call records show calls to international premium rate numbers, high-volume domestic calls, or unusual geographic destinations following the authentication bypass — this indicates active toll fraud with direct financial impact.
- !Escalate to incident response if FreePBX admin logs show creation of new admin accounts, modification of SIP trunks, or changes to dial plan routing rules, as these indicate the attacker achieved full administrative control and may have established persistence.
- !Escalate if the compromised FreePBX system has network connectivity to internal corporate systems beyond the VoIP VLAN, as lateral movement risk is elevated.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Web server access logs showing successful HTTP 200/302 responses to /admin/config.php or /admin/ajax.php without preceding authenticated session establishment - >
FreePBX audit log entries (/admin/modules/logfiles/) showing configuration changes without a corresponding authenticated admin login event - >
MySQL/MariaDB binary logs showing INSERT or UPDATE statements to FreePBX admin tables during the exploitation window - >
Asterisk CDR (Call Detail Records) in /var/spool/asterisk/monitor/ or the FreePBX CDR module showing anomalous outbound calls following the breach - >
Modified or newly created files under /etc/asterisk/extensions_custom.conf or /etc/asterisk/sip_custom.conf indicating dial plan tampering
Tuning Guidance
Reduce false positives by maintaining an allowlist of known administrator IP ranges (corporate egress IPs, VPN concentrator IPs) and excluding them from alerting. Set the request count threshold based on your organization's normal admin access frequency — for environments with a single admin, even 1 external request to admin paths should alert. Correlate with authentication events from FreePBX logs: if a 200 response to an admin path is NOT preceded by a POST to a login endpoint within the same session, confidence in exploitation increases significantly. Consider adding user-agent analysis — automated exploit tools often use non-browser user agents or default curl/python-requests strings.
Hunting Queries
Hunt for off-hours access to FreePBX admin endpoints that could indicate unauthorized access by external threat actors exploiting CVE-2019-19006 outside normal business hours.
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestURL has '/admin/'
| where EventOutcome in ('200', '302')
| extend Hour = datetime_part('hour', TimeGenerated)
| where Hour !between (8 .. 18)
| summarize OffHoursAdminAccess = count() by SourceIP, RequestURL, bin(TimeGenerated, 1h)
| where OffHoursAdminAccess >= 1
| order by OffHoursAdminAccess descindex=web sourcetype=access_combined uri_path="/admin/*" status=200
| eval hour=strftime(_time, "%H")
| where hour < 8 OR hour > 18
| stats count as off_hours_requests, values(uri_path) as paths by clientip, date_mday, date_month
| where off_hours_requests >= 1
| sort -off_hours_requestsHunt for source IPs accessing a high diversity of FreePBX admin paths within a short window, indicative of post-authentication-bypass enumeration or automated exploitation tooling.
CommonSecurityLog
| where TimeGenerated >= ago(7d)
| where RequestURL has '/admin/'
| where EventOutcome == '200'
| summarize UniqueAdminPaths = dcount(RequestURL), RequestCount = count() by SourceIP, bin(TimeGenerated, 1h)
| where UniqueAdminPaths >= 5
| order by UniqueAdminPaths descindex=web sourcetype=access_combined uri_path="/admin/*" status=200
| bin _time span=1h
| stats dc(uri_path) as unique_paths, count as total_requests by clientip, _time
| where unique_paths >= 5
| sort -unique_pathsAtomic Red Team Tests
Simulates an attacker probing the FreePBX admin panel to test for the CVE-2019-19006 authentication bypass by directly requesting the admin configuration page without providing valid session credentials.
Command
curl -v -L --max-redirs 5 -c /tmp/freepbx_cookies.txt -b /tmp/freepbx_cookies.txt -A 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36' 'http://<TARGET_IP>/admin/config.php' 2>&1 | grep -E 'HTTP/|Location:|Set-Cookie:|<title>'Cleanup
rm -f /tmp/freepbx_cookies.txtExpected Telemetry
Web server access log entry showing GET /admin/config.php returning HTTP 200 with no prior authenticated session POST to login endpoint. No Set-Cookie with valid session token in prior requests.
Expected Detection
Detection rule triggers on successful HTTP 200 response to /admin/config.php from the test source IP. Alert should fire in the SIEM within the configured time window.
Simulates post-bypass enumeration of FreePBX admin AJAX endpoints that would allow an attacker to extract configuration data such as SIP trunk credentials and extension lists.
Command
for endpoint in 'ajax.php?module=core&command=getExtensions' 'ajax.php?module=trunks&command=getTrunks' 'ajax.php?module=outbound_routes&command=getRoutes'; do echo "=== Testing: $endpoint ==="; curl -s -o /dev/null -w '%{http_code} %{url_effective}\n' -A 'Mozilla/5.0' "http://<TARGET_IP>/admin/$endpoint"; sleep 1; doneCleanup
No cleanup required — read-only probe requests.Expected Telemetry
Multiple HTTP GET requests to /admin/ajax.php with varying query parameters from the same source IP within a short time window. Response codes of 200 indicate the endpoints are reachable without authentication.
Expected Detection
Detection rules trigger on rapid sequential successful requests to /admin/ajax.php from a single source IP. Aggregation-based rules should fire when request_count exceeds threshold within the time window.
Simulates an attacker who has bypassed authentication attempting to create a new admin user account via the FreePBX admin interface to establish persistent administrative access.
Command
curl -v -X POST 'http://<TARGET_IP>/admin/config.php' -H 'Content-Type: application/x-www-form-urlencoded' -A 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' --data 'display=userman&action=addUser&username=testbackdoor&password=TestP4ssw0rd!&[email protected]' -c /tmp/freepbx_session.txt -b /tmp/freepbx_session.txt 2>&1Cleanup
rm -f /tmp/freepbx_session.txt; # In lab: log into FreePBX admin and delete the 'testbackdoor' user if created successfullyExpected Telemetry
HTTP POST to /admin/config.php with user creation parameters visible in request body. If exploitation succeeds, FreePBX audit logs should show a new user account creation without a corresponding prior admin login. MySQL binary logs capture INSERT into user tables.
Expected Detection
Detection fires on POST request to /admin/config.php from unauthenticated or externally-sourced session. If integrated with FreePBX audit log ingestion, a secondary alert may fire on user_created event without preceding authenticated_login event from the same session ID.
Simulates attacker reconnaissance to discover internet-exposed FreePBX admin interfaces vulnerable to CVE-2019-19006 by probing common VoIP management ports and paths.
Command
nmap -sV -p 80,443,8080,8443 --script http-title,http-headers <TARGET_SUBNET> 2>/dev/null | grep -A3 -B3 'FreePBX\|Asterisk\|PBX'; echo '---'; curl -sk 'https://<TARGET_IP>/admin/' -o /dev/null -w 'HTTPS Admin: %{http_code}\n'; curl -sk 'http://<TARGET_IP>/admin/' -o /dev/null -w 'HTTP Admin: %{http_code}\n'Cleanup
No cleanup required — passive reconnaissance only.Expected Telemetry
Network scan traffic visible in IDS/IPS logs and firewall flow logs. HTTP probes to /admin/ path generate web server access log entries. Port scan signatures may trigger on receiving host if endpoint detection is installed.
Expected Detection
Network-layer detection for port scan activity from the test source IP. Application-layer detection for HTTP probe to /admin/ path. Combination of both events from same source IP within a short window increases confidence of coordinated reconnaissance.