RCE in FreePBX Rest Phone Apps (restapps)

Successful exploitation allows a remote attacker to execute arbitrary commands on the target FreePBX host. In observed campaigns, this was followed by installation of persistent PHP web shells, creation of privileged or root-level accounts, password resets, SSH key insertion, configuration theft, system and Asterisk/FreePBX reconnaissance, and abuse of telephony resources including outbound call activity and likely toll fraud. Because the target is a PBX platform, compromise can also expose call-management data and enable long-term administrative control of voice infrastructure.

If immediate patching is not possible, disable or remove the Rest Phone Apps module, restrict access to the FreePBX administrative/web interface to trusted management networks only, and block direct internet exposure. Monitor for suspicious requests to restapps-related paths and for indicators of web-shell deployment in common FreePBX/Elastix web directories. Audit for unauthorized root or administrative accounts, unexpected cron-based re-download tasks, modified .htaccess or PHP files, SSH key changes, and anomalous Asterisk activity such as unauthorized call origination. Apply network controls, WAF/IPS protections where available, and isolate affected PBX systems until they can be patched and validated.

Upgrade the Rest Phone Apps (restapps) module to a fixed release: 15.0.20 or 16.0.19, as applicable. Identify and remove vulnerable versions 15.0.19.87, 15.0.19.88, 16.0.18.40, and 16.0.18.41 from exposed systems. Given confirmed in-the-wild exploitation, any internet-exposed or suspiciously behaving FreePBX/Elastix instance with the vulnerable module installed should be treated as potentially fully compromised: remove malicious web shells, review web-accessible PHP files for unauthorized additions or timestamp spoofing, audit cron jobs, local users, SSH authorized_keys, password changes, and PBX configuration integrity, and rotate all credentials and keys associated with the system. Rebuild from known-good media if compromise is confirmed or cannot be ruled out.