User creatable call looping bug potentially enabling users to ddos the system.

Status
Not open for further replies.

mpruett

Free User
Joined
Jan 22, 2022
Messages
13
Reaction score
1
We recently encountered an issue with one of our users that had put our companies main number as their mobile number, and then enabled the "Also ring my mobile" option. Then when an internal user calls this extension it will result in hundreds of failed calls and also trigger an error about calls being blocked because the licensed simultaneous calls limit was exceeded. So in theory this could prevent someone from making a call while this loop is active, though it seems to only take a second or two to resolve. In the case of this user it may have been an intentional effort to appear available, while not answering the queue that they were in.

So this raises several questions/requests/concerns:
1. In our case none of our users would need the "Also ring my mobile" option as they all have 3cx installed on their cell. As such, we would like to disable this option. Is there a way? If not consider this a feature request.

2. We don't need or want users to change their mobile number. As above, is there a way to restrict access to this?

3. Is there a way to prevent loops like this? Possibly via a rule? number blacklist? trunk options? Could this behavior be considered a bug?

Thanks.
 
Status
Not open for further replies.

Forum statistics

Threads
111,972
Messages
590,068
Members
164,888
Latest member
Tim Cook