CVE-2020-37153
📋 TL;DR
CVE-2020-37153 allows attackers to execute arbitrary system commands and perform cross-site scripting attacks in ASTPP VoIP billing software. This can lead to complete system compromise, session hijacking, and privilege escalation to root. Organizations running vulnerable ASTPP versions are affected.
💻 Affected Systems
- ASTPP (Open Source VoIP Billing Solution)
📦 What is this software?
Astpp by Inextrix
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root privileges, data exfiltration, installation of persistent backdoors, and use as pivot point for network attacks.
Likely Case
Remote code execution leading to service disruption, credential theft, and installation of cryptocurrency miners or ransomware.
If Mitigated
Limited impact with proper network segmentation, but still potential for service disruption if exploited.
🎯 Exploit Status
Exploit requires authentication but can be combined with XSS to hijack sessions. Public exploit code available on Exploit-DB.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.2 or later
Vendor Advisory: https://github.com/iNextrix/ASTPP
Restart Required: Yes
Instructions:
1. Backup current installation and database. 2. Download latest version from official repository. 3. Follow upgrade instructions in documentation. 4. Restart web server and verify functionality.
🔧 Temporary Workarounds
Network Segmentation
linuxRestrict access to ASTPP web interface to trusted IP addresses only
iptables -A INPUT -p tcp --dport 80 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Web Application Firewall
allDeploy WAF with rules to block command injection and XSS patterns
🧯 If You Can't Patch
- Implement strict input validation and output encoding in affected interfaces
- Disable or restrict plugin management and SIP device configuration interfaces
🔍 How to Verify
Check if Vulnerable:
Check ASTPP version in web interface admin panel or via command: grep 'version' /var/www/html/astpp/application/config/version.phpCheck Version:
grep "\$config['version']" /var/www/html/astpp/application/config/version.phpVerify Fix Applied:
Verify version is 4.0.2 or higher and test that command injection payloads are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual cron job entries in /var/log/cron
- Web server logs showing command injection patterns (; | ` $() )
- Multiple failed login attempts followed by successful admin login
Network Indicators:
- Unusual outbound connections from ASTPP server
- Traffic to known malicious IPs or domains
SIEM Query:
source="web_access.log" AND ("cmd=" OR "exec=" OR "system=" OR "passthru=" OR "shell_exec=") AND dest_ip="ASTPP_SERVER_IP"