CVE-2021-43405: Other (NVD-CWE-Other)
value: An issue was discovered in FusionPBX before 4.5.30. The fax_extension may have risky characters (it is not constrained to be numeric).
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 8.8
Published: 2021-11-05T18:15Z
Repository: https://github.com/fusionpbx/fusionpbx
Language: PHP
Files changed: app/fax/fax_send.php
Commit date: 2021-11-02 21:55:15 -0600
Commit message: Require the fax_extension to be numeric.

Need to validate that the fax_extension really is numeric. Also replace event_socket_mkdir that makes a directory with mkdir.lua and use a php mkdir function instead. We want to offload this off of FreeSWITCH and its safer to use the PHP function.
Diff: diff --git a/app/fax/fax_send.php b/app/fax/fax_send.php
index 2b58772c34..9e1c651f4f 100644
--- a/app/fax/fax_send.php
+++ b/app/fax/fax_send.php
@@ -15,11 +15,11 @@
 
 	The Original Code is FusionPBX
 
 	The Initial Developer of the Original Code is
 	Mark J Crane <markjcrane@fusionpbx.com>
-	Portions created by the Initial Developer are Copyright (C) 2008-2020
+	Portions created by the Initial Developer are Copyright (C) 2008-2021
 	the Initial Developer. All Rights Reserved.
 
 	Contributor(s):
 	Mark J Crane <markjcrane@fusionpbx.com>
 	James Rose <james.o.rose@gmail.com>
@@ -51,11 +51,11 @@ if (!$included) {
 	//add multi-lingual support
 		$language = new text;
 		$text = $language->get();
 
 	//get the fax_extension and save it as a variable
-		if (strlen($_REQUEST["fax_extension"]) > 0) {
+		if (isset($_REQUEST["fax_extension"]) && is_numeric($_REQUEST["fax_extension"])) {
 			$fax_extension = $_REQUEST["fax_extension"];
 		}
 
 	//pre-populate the form
 		if (is_uuid($_REQUEST['id']) && $_POST["persistformvar"] != "true") {
@@ -212,37 +212,37 @@ if (!function_exists('fax_split_dtmf')) {
 		}
 	}
 }
 
 //get the fax extension
-	if (strlen($fax_extension) > 0) {
+	if (isset($fax_extension) && is_numeric($fax_extension)) {
 		//set the fax directories. example /usr/local/freeswitch/storage/fax/329/inbox
 			$dir_fax_inbox = $fax_dir.'/'.$fax_extension.'/inbox';
 			$dir_fax_sent = $fax_dir.'/'.$fax_extension.'/sent';
 			$dir_fax_temp = $fax_dir.'/'.$fax_extension.'/temp';
 
 		//make sure the directories exist
 			if (!is_dir($_SESSION['switch']['storage']['dir'])) {
-				event_socket_mkdir($_SESSION['switch']['storage']['dir']);
+				mkdir($_SESSION['switch']['storage']['dir'], 0770);
 			}
 			if (!is_dir($_SESSION['switch']['storage']['dir'].'/fax')) {
-				event_socket_mkdir($_SESSION['switch']['storage']['dir'].'/fax');
+				mkdir($_SESSION['switch']['storage']['dir'].'/fax', 0770);
 			}
 			if (!is_dir($_SESSION['switch']['storage']['dir'].'/fax/'.$_SESSION['domain_name'])) {
-				event_socket_mkdir($_SESSION['switch']['storage']['dir'].'/fax/'.$_SESSION['domain_name']);
+				mkdir($_SESSION['switch']['storage']['dir'].'/fax/'.$_SESSION['domain_name'], 0770);
 			}
 			if (!is_dir($fax_dir.'/'.$fax_extension)) {
-				event_socket_mkdir($fax_dir.'/'.$fax_extension);
+				mkdir($fax_dir.'/'.$fax_extension, 0770);
 			}
 			if (!is_dir($dir_fax_inbox)) {
-				event_socket_mkdir($dir_fax_inbox);
+				mkdir($dir_fax_inbox, 0770);
 			}
 			if (!is_dir($dir_fax_sent)) {
-				event_socket_mkdir($dir_fax_sent);
+				mkdir($dir_fax_sent, 0770);
 			}
 			if (!is_dir($dir_fax_temp)) {
-				event_socket_mkdir($dir_fax_temp);
+				mkdir($dir_fax_temp, 0770);
 			}
 	}
 
 //clear file status cache
 	clearstatcache();

Vulnerable code: 	Portions created by the Initial Developer are Copyright (C) 2008-2020
		if (strlen($_REQUEST["fax_extension"]) > 0) {
	if (strlen($fax_extension) > 0) {
				event_socket_mkdir($_SESSION['switch']['storage']['dir']);
				event_socket_mkdir($_SESSION['switch']['storage']['dir'].'/fax');
				event_socket_mkdir($_SESSION['switch']['storage']['dir'].'/fax/'.$_SESSION['domain_name']);
				event_socket_mkdir($fax_dir.'/'.$fax_extension);
				event_socket_mkdir($dir_fax_inbox);
				event_socket_mkdir($dir_fax_sent);
				event_socket_mkdir($dir_fax_temp);
Fixed code: 	Portions created by the Initial Developer are Copyright (C) 2008-2021
		if (isset($_REQUEST["fax_extension"]) && is_numeric($_REQUEST["fax_extension"])) {
	if (isset($fax_extension) && is_numeric($fax_extension)) {
				mkdir($_SESSION['switch']['storage']['dir'], 0770);
				mkdir($_SESSION['switch']['storage']['dir'].'/fax', 0770);
				mkdir($_SESSION['switch']['storage']['dir'].'/fax/'.$_SESSION['domain_name'], 0770);
				mkdir($fax_dir.'/'.$fax_extension, 0770);
				mkdir($dir_fax_inbox, 0770);
				mkdir($dir_fax_sent, 0770);
				mkdir($dir_fax_temp, 0770);