CVE-2022-35153: Improper Encoding or Escaping of Output (CWE-116)
value: FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php.
CWE description: The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CVSS v3 base score: 9.8
Published: 2022-08-18T05:15Z
Repository: https://github.com/fusionpbx/fusionpbx
Language: PHP
Files changed: app/fax/fax_send.php
Commit date: 2022-06-29 10:24:05 -0600
Commit message: Security use escapeshellarg
Diff: diff --git a/app/fax/fax_send.php b/app/fax/fax_send.php
index 777e244096..a8808a0a27 100644
--- a/app/fax/fax_send.php
+++ b/app/fax/fax_send.php
@@ -310,21 +310,21 @@ if (!function_exists('fax_split_dtmf')) {
 
 				//convert uploaded file to pdf, if necessary
 				if ($fax_file_extension != "pdf" && $fax_file_extension != "tif") {
 					chdir($dir_fax_temp);
 					$command = $IS_WINDOWS ? '' : 'export HOME=/tmp && ';
-					$command .= 'libreoffice --headless --convert-to pdf --outdir '.$dir_fax_temp.' '.$dir_fax_temp.'/'.$fax_name.'.'.$fax_file_extension;
+					$command .= 'libreoffice --headless --convert-to pdf --outdir '.$dir_fax_temp.' '.$dir_fax_temp.'/'.escapeshellarg($fax_name).'.'.escapeshellarg($fax_file_extension);
 					exec($command);
 					@unlink($dir_fax_temp.'/'.$fax_name.'.'.$fax_file_extension);
 				}
 
 				//convert uploaded pdf to tif
 				if (file_exists($dir_fax_temp.'/'.$fax_name.'.pdf')) {
 					chdir($dir_fax_temp);
 
 					//convert pdf to tif
-					$cmd = exec('which gs')." -q -r".$gs_r." -g".$gs_g." -dBATCH -dPDFFitPage -dNOSAFER -dNOPAUSE -dBATCH -sOutputFile=".correct_path($fax_name).".tif -sDEVICE=tiffg4 -Ilib stocht.ps -c \"{ .75 gt { 1 } { 0 } ifelse} settransfer\" -- ".correct_path($fax_name).".pdf -c quit";
+					$cmd = exec('which gs')." -q -r".$gs_r." -g".$gs_g." -dBATCH -dPDFFitPage -dNOSAFER -dNOPAUSE -dBATCH -sOutputFile=".escapeshellarg($fax_name).".tif -sDEVICE=tiffg4 -Ilib stocht.ps -c \"{ .75 gt { 1 } { 0 } ifelse} settransfer\" -- ".escapeshellarg($fax_name).".pdf -c quit";
 					// echo($cmd . "<br/>\n");
 					exec($cmd);
 					@unlink($dir_fax_temp.'/'.$fax_name.'.pdf');
 				}
 
@@ -670,21 +670,21 @@ if (!function_exists('fax_split_dtmf')) {
 		//set the fax
 		$fax_queue_uuid = uuid();
 
 		//send the fax
 		$fax_file = $dir_fax_sent."/".$fax_instance_uuid.".tif";
-		$common_variables .= "fax_queue_uuid='"               . $fax_queue_uuid          . "',";
+		$common_variables .= "fax_queue_uuid='"               . escapeshellarg($fax_queue_uuid)          . "',";
 		$common_variables  = "for_fax=1,";
-		$common_variables .= "accountcode='"                  . $fax_accountcode         . "',";
-		$common_variables .= "sip_h_X-accountcode='"          . $fax_accountcode         . "',";
-		$common_variables .= "domain_uuid="                   . $_SESSION["domain_uuid"] . ",";
-		$common_variables .= "domain_name="                   . $_SESSION["domain_name"] . ",";
-		$common_variables .= "origination_caller_id_name='"   . $fax_caller_id_name      . "',";
-		$common_variables .= "origination_caller_id_number='" . $fax_caller_id_number    . "',";
-		$common_variables .= "fax_ident='"                    . $fax_caller_id_number    . "',";
-		$common_variables .= "fax_header='"                   . $fax_caller_id_name      . "',";
-		$common_variables .= "fax_file='"                     . $fax_file                . "',";
+		$common_variables .= "accountcode='"                  . escapeshellarg($fax_accountcode)         . "',";
+		$common_variables .= "sip_h_X-accountcode='"          . escapeshellarg($fax_accountcode)         . "',";
+		$common_variables .= "domain_uuid="                   . escapeshellarg($_SESSION["domain_uuid"]) . ",";
+		$common_variables .= "domain_name="                   . escapeshellarg($_SESSION["domain_name"]) . ",";
+		$common_variables .= "origination_caller_id_name='"   . escapeshellarg($fax_caller_id_name)      . "',";
+		$common_variables .= "origination_caller_id_number='" . escapeshellarg($fax_caller_id_number)    . "',";
+		$common_variables .= "fax_ident='"                    . escapeshellarg($fax_caller_id_number)    . "',";
+		$common_variables .= "fax_header='"                   . escapeshellarg($fax_caller_id_name)      . "',";
+		$common_variables .= "fax_file='"                     . escapeshellarg($fax_file)               . "',";
 
 		foreach ($fax_numbers as $fax_number) {
 
 			$fax_number = trim($fax_number);
 			fax_split_dtmf($fax_number, $fax_dtmf);
@@ -702,20 +702,20 @@ if (!function_exists('fax_split_dtmf')) {
 			else {
 				//send the external call
 				$fax_uri = $route_array[0];
 				$fax_variables = "";
 				foreach($_SESSION['fax']['variable'] as $variable) {
-					$fax_variables .= $variable.",";
+					$fax_variables .= escapeshellarg($variable).",";
 				}
 			}
 
 			//build the fax dial string
 			$dial_string = $common_variables;
 			$dial_string .= $fax_variables;
-			$dial_string .= "mailto_address='"     . $mail_to_address   . "',";
-			$dial_string .= "mailfrom_address='"   . $mail_from_address . "',";
-			$dial_string .= "fax_uri=" . $fax_uri  . ",";
+			$dial_string .= "mailto_address='"     . escapeshellarg($mail_to_address)   . "',";
+			$dial_string .= "mailfrom_address='"   . escapeshellarg($mail_from_address) . "',";
+			$dial_string .= "fax_uri="             . escapeshellarg($fax_uri)           . ",";
 			$dial_string .= "fax_retry_attempts=1" . ",";
 			$dial_string .= "fax_retry_limit=20"   . ",";
 			$dial_string .= "fax_retry_sleep=180"  . ",";
 			$dial_string .= "fax_verbose=true"     . ",";
 			$dial_string .= "fax_use_ecm=off"      . ",";

Vulnerable code: 					$command .= 'libreoffice --headless --convert-to pdf --outdir '.$dir_fax_temp.' '.$dir_fax_temp.'/'.$fax_name.'.'.$fax_file_extension;
					$cmd = exec('which gs')." -q -r".$gs_r." -g".$gs_g." -dBATCH -dPDFFitPage -dNOSAFER -dNOPAUSE -dBATCH -sOutputFile=".correct_path($fax_name).".tif -sDEVICE=tiffg4 -Ilib stocht.ps -c \"{ .75 gt { 1 } { 0 } ifelse} settransfer\" -- ".correct_path($fax_name).".pdf -c quit";
		$common_variables .= "fax_queue_uuid='"               . $fax_queue_uuid          . "',";
		$common_variables .= "accountcode='"                  . $fax_accountcode         . "',";
		$common_variables .= "sip_h_X-accountcode='"          . $fax_accountcode         . "',";
		$common_variables .= "domain_uuid="                   . $_SESSION["domain_uuid"] . ",";
		$common_variables .= "domain_name="                   . $_SESSION["domain_name"] . ",";
		$common_variables .= "origination_caller_id_name='"   . $fax_caller_id_name      . "',";
		$common_variables .= "origination_caller_id_number='" . $fax_caller_id_number    . "',";
		$common_variables .= "fax_ident='"                    . $fax_caller_id_number    . "',";
		$common_variables .= "fax_header='"                   . $fax_caller_id_name      . "',";
		$common_variables .= "fax_file='"                     . $fax_file                . "',";
					$fax_variables .= $variable.",";
			$dial_string .= "mailto_address='"     . $mail_to_address   . "',";
			$dial_string .= "mailfrom_address='"   . $mail_from_address . "',";
			$dial_string .= "fax_uri=" . $fax_uri  . ",";
Fixed code: 					$command .= 'libreoffice --headless --convert-to pdf --outdir '.$dir_fax_temp.' '.$dir_fax_temp.'/'.escapeshellarg($fax_name).'.'.escapeshellarg($fax_file_extension);
					$cmd = exec('which gs')." -q -r".$gs_r." -g".$gs_g." -dBATCH -dPDFFitPage -dNOSAFER -dNOPAUSE -dBATCH -sOutputFile=".escapeshellarg($fax_name).".tif -sDEVICE=tiffg4 -Ilib stocht.ps -c \"{ .75 gt { 1 } { 0 } ifelse} settransfer\" -- ".escapeshellarg($fax_name).".pdf -c quit";
		$common_variables .= "fax_queue_uuid='"               . escapeshellarg($fax_queue_uuid)          . "',";
		$common_variables .= "accountcode='"                  . escapeshellarg($fax_accountcode)         . "',";
		$common_variables .= "sip_h_X-accountcode='"          . escapeshellarg($fax_accountcode)         . "',";
		$common_variables .= "domain_uuid="                   . escapeshellarg($_SESSION["domain_uuid"]) . ",";
		$common_variables .= "domain_name="                   . escapeshellarg($_SESSION["domain_name"]) . ",";
		$common_variables .= "origination_caller_id_name='"   . escapeshellarg($fax_caller_id_name)      . "',";
		$common_variables .= "origination_caller_id_number='" . escapeshellarg($fax_caller_id_number)    . "',";
		$common_variables .= "fax_ident='"                    . escapeshellarg($fax_caller_id_number)    . "',";
		$common_variables .= "fax_header='"                   . escapeshellarg($fax_caller_id_name)      . "',";
		$common_variables .= "fax_file='"                     . escapeshellarg($fax_file)               . "',";
					$fax_variables .= escapeshellarg($variable).",";
			$dial_string .= "mailto_address='"     . escapeshellarg($mail_to_address)   . "',";
			$dial_string .= "mailfrom_address='"   . escapeshellarg($mail_from_address) . "',";
			$dial_string .= "fax_uri="             . escapeshellarg($fax_uri)           . ",";