GHSA-xjxm-9qx6-w3fj: FreeSWITCH: Channel-variable injection via SIP REFER leads to command execution in mod_sofia

FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.2, sofiahandlesipirefer() placed raw Refer-To URI parameters and headers inside a sipinviteparams channel-variable block passed to switchivroriginate(). The originate parser treated a comma in the attacker-controlled value as a variable separator, allowing an authenticated caller on a bridged call to inject arbitrary variables into a newly originated leg. An injected executeonoriginate value could invoke the system dialplan application before answer and execute operating-system commands with the FreeSWITCH process privileges. SIP REFER is enabled by default, and the sender needs only a registered account and a call that takes the off-box transfer path, not administrative or Event Socket access. This issue is fixed in version 1.11.2.