Critical RCE Bugs Found in Pascom Cloud Phone System Used by Businesses

Researchers have disclosed three security vulnerabilities
affecting Pascom Cloud Phone System (CPS^[1]) that could be combined
to achieve a full pre-authenticated remote code execution of
affected systems.

Kerbit security researcher Daniel Eshetu said^[2] the shortcomings, when
chained together, can lead to “an unauthenticated attacker gaining
root on these devices.”

Pascom Cloud Phone System is an integrated collaboration and
communication solution that allows businesses to host and set up
private telephone networks across different platforms as well as
facilitate the monitoring, maintenance, and updates associated with
the virtual phone systems.

The set of three flaws includes those stemming from an arbitrary
path traversal in the web interface, a server-side request forgery
(SSRF^[3]) due to an outdated
third-party dependency (CVE-2019-18394^[4]), and a
post-authentication command injection using a daemon service
(“exd.pl”).

In other words, the vulnerabilities can be stringed in a
chain-like fashion to access non-exposed endpoints by sending
arbitrary GET requests to obtain the administrator password, and
then use it to gain remote code execution using the scheduled
task.

The exploit chain can be used “to execute commands as root,”
Eshetu said, adding, “this gives us full control of the machine and
an easy way to escalate privileges.” The flaws were reported to
Pascom on January 3, 2022, following which patches have been
released.

Customers who are self-hosting CPS as opposed to on the cloud
are advised to update to the latest version (pascom Server 19.21^[5]) as soon as possible to
counter any potential threats.