FOP2 Community Forum

Hi, Good news! I have just released version 2.31.46 that fixes the issue. You can upgrade with this command:

wget -O - https://download.fop2.com/upgrade_fop2.sh | bash

Hi Chris,
I think we looked at your system the other day via remote. It turns out you have a separate database server and FOP2 is configured to pull information from that separate server, where those new extensions are not populated. Please review your configuration, or move the freepbx config file so it checks your local database instead of the remote one.

Hi,

once session is initiated in FOP2, it will make some ajax calls to set session variables to setvar.php, you can troubleshoot those using the developer console on your browser, network tab for xhr requests.

Those session variables are there for security to not let malicious users attempt to retrieve other files from the system.

What do you see if you try to download the recording ?

Hi, you can open the javascript console in your browser, and look for any possible error or warning when you attempt to download/play, that will give me an idea of what could be wrong.

You are right, the fix apply to the Asternic Call Center Stats DEVEL version. Setting a strong password for the admin user or perhaps also renaming the admin user to something else will prevent the automated script kiddie attack.

We received information about a compromised system that had Asternic Call Center Stats PRO. Upon investigation we confirmed that it was possible to upload arbitrary files via the admin-language.php file, but only for authenticated users.

We then noticed that old RPM versions of the software in Issabel repositories were installed with insecure/default credentials. This does not happen if installing according to the installation guide using the command line install scripts instead of yum/rpm, as the command line installation prompts for the administrator password at install time. So we decided to pull those old .rpm versions from Issabel repositories.

Even if its only exploitable by authenticated users, it is still a serious security vulnerability. We already patched the software and urge you to upgrade to the latest version (2.3.11) available since today.

One way to find out if your server could have been compromised is to look for .php files in the /var/www/html/stats/uploads directory:

find /var/www/html/stats/uploads -name \*.php

If this command returns any files, those are most probably malicious and your system is compromised.

If you cannot upgrade, a quick fix is to edit the file /var/www/html/stats/admin-language.php, search for 'allow_import' and change it to false, like this:

$grid->allow_import(false);

Hi,

If you are using the latest version as of today (2.31.36), try the following to see if it fixes the issue:

cd /var/www/html/fop2/js
mv fop2.js fop2.js.orig
wget download.fop2.com/fop2.js

Then clear cache and reload your FOP2.

For anyone coming here, the creation of separate 99X users and devices by FOP2 manager can be toggled by modifying /var/www/html/fop2/admin/config.php

$ZULU_COMBINE= true
Won't create 99xx devices, they will be added as an extra channel for the regular xx PJSIP device.
$ZULU_COMBINE = false

Will create both 99xx and xx devices as separate entities (thus, if creating a fop2 user 99xx it will be able to use the webrtc phone in FOP2.

Usually this happens when there is actually a client disconnection (browser disconnects from websocket). the logout callback_timeout prevents the logout callback to trigger, but it won't prevent the GUI from refreshing. The fix is trying to find out why clients are being disconnected, there are other settings in fop2.cfg that will force client disconnections (kick_inactive_clients and client_timeout). You will want to check those settings in fop2.cfg (client_timeout=0 and kick_inactive_clients=5000) or something to that effect. Also, do not put FOP2 tab as a background tab as Chrome might want to economize battery and close every connection from the tab, triggering that problem.

If you are within the yearly support/upgrades, you can upgrade to the latest version with this command:

wget -O - http://download.fop2.com/upgrade_fop2.sh | bash

If you are not within the year, then you can download the same FOP2 version from our site (www.fop2.com/download.php), extract and install over (all previous affected versions are already patched). Suppose you have version 2.29.03 and you want to reinstall, you should do this (assuming you have FreePBX/Issabel based on Centos 64 bits:

cd /usr/src
wget download.fop2.com/fop2-2.29.03-centos-x86_64.tgz
tar zxvr fop2-2.29.03-centos-x86_64.tgz
cd fop2
make install

If you have other versions, follow the naming convention to get the appropriate one (you can check versions by running /usr/local/fop2/fop2_server -v)

Best regards,

Another file that might indicate your FreePBX server was compromised is this one:

/var/www/html/admin/assets/js/modgettext.js

If it has the word "eval" in it, then it was modified/replaced with malicious code, you can check with the command:

grep eval /var/www/html/admin/assets/js/modgettext.js

If i returns anything, then that file was compromised and you need to restore it from the original source (freepbx rpms).

We have just released FOP2 Manager version 1.2.4 that fixes the vulnerability. You should be able to upgrade directly from the FOP2 Manager dashboard.

We also updated all release tarballs from our repositories. That means that if you reinstall FOP2 from a file downloaded from our sites, it will included the patched files already (From version 2.28 to 2.31.33).

For a couple of days we have received reports of compromised servers from FOP2 users. A preliminary analysis seems to indicate that indeed the attack vector is part of the FOP2 Manager (http://your.server/fop2/admin), more specifically in the files downloadfile.php and chunkdonwloadhelper.php

In case you have the FOP2 interface exposed to the internet and as an urgent measure we suggest you perform the following actions until we can confirm the problem and provide definitive measures to avoid the problem.

Log into your FOP2 Manager dashboard at https://your.server/fop2/admin
You should see the new 1.2.4 version available. Upgrade directly from there. Once done, your server won't be vulnerable any longer.

To find out if your server was already compromised you can check for the existence of the following files that are not part of FOP2 but are injected by attackers to download and run a cryptocurrency mining script:

ls -la /var/www/html/fop2/lang/index.php
ls -la /var/www/html/fop2/lang/ko.php

If you have any of these two files, your computer was compromised, you should delete these files immediately.

The certs in the fop2.cfg file are only read by the websocket server (fop2_server), not your web server. If the user panel is not loading is because most probably it is using incorrect certs. There is a script provided /usr/local/fop2/setSSL.sh that tries to find the cert files from the apache config files and set them accordingly. You might want to try running that script and see if it find the certs and set it up on your fop2.cfg file.

H,

In /usr/local/fop2/fop2.cfg adding the 'q' modifier to either spy_options or whisper_options should remove/silence any announcement, not only the beep. If you still hear that, my guess is that the option was not set correctly in fop2.cfg or fop2 was not restarted after changing it.

If you have a very old FOP2 and a recent asterisk, then you might have some issues with options delimiters. Check the "force_parameter_delimiter" option in fop2.cfg. If you have Asterisk 11 or higher, it must be set to "," if you have really old asterisk then you might need to change it to "|". Either way, FOP2 tries to determine the version and set the delimiter correctly, you can override that detection uncommenting this.

Hi,

Thanks for the feedback.

The latest recordings_fop2.pl script already has the extra 1st field on the split line (on version 2.31.33 at least). It should not be an issue if the script is updated.

No se solucionará actualizando. Los navegadores por política/seguridad/motivos y razones están capando las posibilidades de interacción de aplicaciones sobre todo en segundo plano. Desactivan sonidos, desconectan websockets, etc.. Debería hacer un downgrade de navegador.

FOP2 in itself is not used to write Asterisk configurations files, if that was your usage intention it might not be the right tool. Having said that, you can write a FOP2 plugin that can use Asterisk Manager commands to configure dialplans. How to use such commands is really outside of any kind of scope in this forum or FOP2 itself, you must have a deep knowledge of Asterisk... you willl be using FOP2 just as an AMI toolbox in that case.

AMI Commands related to diaplan generator:

UpdateConfig
DialplanExtensionAdd
DialplanExtensionRemove

Best regards,

Hi, we have a live chat on both of our sites www.fop2.com and www.asternic.net. There are no bots there, you will talk directly to us, and we can schedule remote supports if needed directly there. Before engaging in paid support an initial contact /assesment is needed about the support required, as it might not need to be paid if its a matter of guiding/directing to documented features/knowledge base/faq, or also sometimes is not support related to our products we might not be able to fullfill.

Best regards,