Vulnerability: An issue was discovered in FusionPBX before 4.5.30. The FAX file name may have risky characters.
Vulnerability ID: CVE-2021-43404
CWE: CWE-20
Severity score: 6.4
Project: https://github.com/fusionpbx/fusionpbx
Published: 2021-11-05
File: app/fax/fax_send.php
Commit message: Change the fax file name to md5 to avoid characters that present a security risk.
Commit author: FusionPBX

Vulnerable version (before fix):
 function fax_split_dtmf(&$fax_number, &$fax_dtmf){ 				$disallowed_file_extensions = explode(',','sh,ssh,so,dll,exe,bat,vbs,zip,rar,z,tar,tbz,tgz,gz'); 				if (in_array($fax_file_extension, $disallowed_file_extensions) || $fax_file_extension == '') { continue; }  				$fax_name = $_files['name'][$index]; 				$fax_name = preg_replace('/\\.[^.\\s]{3,4}$/', '', $fax_name); 				$fax_name = str_replace(" ", "_", $fax_name);  				//lua doesn't seem to like special chars with env:GetHeader 				$fax_name = str_replace(";", "_", $fax_name); 				$fax_name = str_replace(",", "_", $fax_name); 				$fax_name = str_replace("'", "_", $fax_name); 				$fax_name = str_replace("!", "_", $fax_name); 				$fax_name = str_replace("@", "_", $fax_name); 				$fax_name = str_replace("#", "_", $fax_name); 				$fax_name = str_replace("$", "_", $fax_name); 				$fax_name = str_replace("%", "_", $fax_name); 				$fax_name = str_replace("^", "_", $fax_name); 				$fax_name = str_replace("`", "_", $fax_name); 				$fax_name = str_replace("~", "_", $fax_name); 				$fax_name = str_replace("&", "_", $fax_name); 				$fax_name = str_replace("(", "_", $fax_name); 				$fax_name = str_replace(")", "_", $fax_name); 				$fax_name = str_replace("+", "_", $fax_name); 				$fax_name = str_replace("=", "_", $fax_name);  				$attachment_file_name = $_files['name'][$index]; 				if ($attachment_file_name != $fax_name.'.'.$fax_file_extension) { 					rename($dir_fax_temp.'/'.$attachment_file_name, $dir_fax_temp.'/'.$fax_name.'.'.$fax_file_extension); function fax_split_dtmf(&$fax_number, &$fax_dtmf){ 				if (!$included) { 					//check if directory exists 					if (!is_dir($dir_fax_temp)) { 						event_socket_mkdir($dir_fax_temp); 					} 					//move uploaded file 					move_uploaded_file($_files['tmp_name'][$index], $dir_fax_temp.'/'.$fax_name.'.'.$fax_file_extension);

Fixed version (after fix):
 function fax_split_dtmf(&$fax_number, &$fax_dtmf){ 				$disallowed_file_extensions = explode(',','sh,ssh,so,dll,exe,bat,vbs,zip,rar,z,tar,tbz,tgz,gz'); 				if (in_array($fax_file_extension, $disallowed_file_extensions) || $fax_file_extension == '') { continue; }  				//use a safe file name 				$fax_name = md5($_files['name'][$index]);  				//rename the file 				$attachment_file_name = $_files['name'][$index]; 				if ($attachment_file_name != $fax_name.'.'.$fax_file_extension) { 					rename($dir_fax_temp.'/'.$attachment_file_name, $dir_fax_temp.'/'.$fax_name.'.'.$fax_file_extension); function fax_split_dtmf(&$fax_number, &$fax_dtmf){ 				if (!$included) { 					//check if directory exists 					if (!is_dir($dir_fax_temp)) { 						mkdir($dir_fax_temp, 0770); 					} 					//move uploaded file 					move_uploaded_file($_files['tmp_name'][$index], $dir_fax_temp.'/'.$fax_name.'.'.$fax_file_extension);

Patch:
patch: @@ -351,28 +351,10 @@ function fax_split_dtmf(&$fax_number, &$fax_dtmf){
 				$disallowed_file_extensions = explode(',','sh,ssh,so,dll,exe,bat,vbs,zip,rar,z,tar,tbz,tgz,gz');
 				if (in_array($fax_file_extension, $disallowed_file_extensions) || $fax_file_extension == '') { continue; }
 
-				$fax_name = $_files['name'][$index];
-				$fax_name = preg_replace('/\\.[^.\\s]{3,4}$/', '', $fax_name);
-				$fax_name = str_replace(" ", "_", $fax_name);
-
-				//lua doesn't seem to like special chars with env:GetHeader
-				$fax_name = str_replace(";", "_", $fax_name);
-				$fax_name = str_replace(",", "_", $fax_name);
-				$fax_name = str_replace("'", "_", $fax_name);
-				$fax_name = str_replace("!", "_", $fax_name);
-				$fax_name = str_replace("@", "_", $fax_name);
-				$fax_name = str_replace("#", "_", $fax_name);
-				$fax_name = str_replace("$", "_", $fax_name);
-				$fax_name = str_replace("%", "_", $fax_name);
-				$fax_name = str_replace("^", "_", $fax_name);
-				$fax_name = str_replace("`", "_", $fax_name);
-				$fax_name = str_replace("~", "_", $fax_name);
-				$fax_name = str_replace("&", "_", $fax_name);
-				$fax_name = str_replace("(", "_", $fax_name);
-				$fax_name = str_replace(")", "_", $fax_name);
-				$fax_name = str_replace("+", "_", $fax_name);
-				$fax_name = str_replace("=", "_", $fax_name);
+				//use a safe file name
+				$fax_name = md5($_files['name'][$index]);
 
+				//rename the file
 				$attachment_file_name = $_files['name'][$index];
 				if ($attachment_file_name != $fax_name.'.'.$fax_file_extension) {
 					rename($dir_fax_temp.'/'.$attachment_file_name, $dir_fax_temp.'/'.$fax_name.'.'.$fax_file_extension);
@@ -382,7 +364,7 @@ function fax_split_dtmf(&$fax_number, &$fax_dtmf){
 				if (!$included) {
 					//check if directory exists
 					if (!is_dir($dir_fax_temp)) {
-						event_socket_mkdir($dir_fax_temp);
+						mkdir($dir_fax_temp, 0770);
 					}
 					//move uploaded file
 					move_uploaded_file($_files['tmp_name'][$index], $dir_fax_temp.'/'.$fax_name.'.'.$fax_file_extension);
path: app/fax/fax_send.php