CVE-2022-35153 (PHP, published 2022-08-18T05:15Z)
Description: value: FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php.
Severity: nan (CVSS v3 base score: 9.8)
Weakness: CWE-116 \u2014 Improper Encoding or Escaping of Output
The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Repository: https://github.com/fusionpbx/fusionpbx
Files changed:
secure/fax_to_email.php
Commit message: Add escapeshellarg to the variables used in the command line.

Vulnerable code:
	
		
						$fax_uri = "user/".$fax_forward_number."@".$domain_name;
							$fax_variables .= $variable.",";
				$dial_string .= "accountcode='"                  . $fax_accountcode         . "',";
				$dial_string .= "sip_h_X-accountcode='"          . $fax_accountcode         . "',";
				$dial_string .= "domain_uuid="                   . $domain_uuid . ",";
				$dial_string .= "domain_name="                   . $domain_name . ",";
				$dial_string .= "origination_caller_id_name='"   . $fax_caller_id_name      . "',";
				$dial_string .= "origination_caller_id_number='" . $fax_caller_id_number    . "',";
				$dial_string .= "fax_ident='"                    . $fax_caller_id_number    . "',";
				$dial_string .= "fax_header='"                   . $fax_caller_id_name      . "',";
				$dial_string .= "fax_file='"                     . $fax_file                . "',";
						$dial_string .= "mailto_address='"     . $mail_to_address   . "',";
						$dial_string .= "mailfrom_address='"   . $mail_from_address . "',";
						$dial_string .= "fax_uri=" . $fax_uri  . ",";
						$dial_string = "{" . $dial_string . "}" . $fax_uri." &txfax('".$fax_file."')";
			else {
				//create an instruction log to email messages once the connection to the mail server has been restored
					$fp = fopen($fax_to_email_queue_dir."/failed_fax_emails.log", "a");
					fwrite($fp, PHP_BINDIR."/php ".$_SERVER["DOCUMENT_ROOT"].PROJECT_PATH."/secure/fax_to_email.php email='".$fax_email."' extension=".$fax_extension." name='".$fax_file."' messages='".$fax_messages."' domain=".$domain_name." caller_id_name='".$caller_id_name."' caller_id_number=".$caller_id_number." retry=true\n");
					fclose($fp);
				//create a script to do the delayed mailing
					$fp = fopen($_SESSION['server']['temp']['dir']."/failed_fax_emails.sh", "w");
					fwrite($fp, "rm ".$_SESSION['server']['temp']['dir']."/fax_email_retry.sh\n");
					fwrite($fp, "mv ".$fax_to_email_queue_dir."/failed_fax_emails.log ".$_SESSION['server']['temp']['dir']."/fax_email_retry.sh\n");
					fwrite($fp, "chmod 777 ".$_SESSION['server']['temp']['dir']."/fax_email_retry.sh\n");
					fwrite($fp, $_SESSION['server']['temp']['dir']."/fax_email_retry.sh\n");
					fclose($fp);
					$tmp_response = exec("chmod 777 ".$_SESSION['server']['temp']['dir']."/failed_fax_emails.sh");
				//note we use batch in order to execute when system load is low.  Alternatively this could be replaced with AT.
					$tmp_response = exec("at -f ".$_SESSION['server']['temp']['dir']."/failed_fax_emails.sh now + 3 minutes");
				
			}

Fixed code:


						$fax_uri = "user/".escapeshellarg($fax_forward_number)."@".escapeshellarg($domain_name);
							$fax_variables .= escapeshellarg($variable).",";
				$dial_string .= "accountcode='"                  . escapeshellarg($fax_accountcode)         . "',";
				$dial_string .= "sip_h_X-accountcode='"          . escapeshellarg($fax_accountcode)         . "',";
				$dial_string .= "domain_uuid="                   . escapeshellarg($domain_uuid)             . ",";
				$dial_string .= "domain_name="                   . escapeshellarg($domain_name)             . ",";
				$dial_string .= "origination_caller_id_name='"   . escapeshellarg($fax_caller_id_name)      . "',";
				$dial_string .= "origination_caller_id_number='" . escapeshellarg($fax_caller_id_number)    . "',";
				$dial_string .= "fax_ident='"                    . escapeshellarg($fax_caller_id_number)    . "',";
				$dial_string .= "fax_header='"                   . escapeshellarg($fax_caller_id_name)      . "',";
				$dial_string .= "fax_file='"                     . escapeshellarg($fax_file)                . "',";
						$dial_string .= "mailto_address='"     . escapeshellarg($mail_to_address)   . "',";
						$dial_string .= "mailfrom_address='"   . escapeshellarg($mail_from_address) . "',";
						$dial_string .= "fax_uri="             . escapeshellarg($fax_uri)  . ",";
						$dial_string = "{" . $dial_string . "}" . escapeshellarg($fax_uri)." &txfax('".escapeshellarg($fax_file)."')";