CVE-2021-31584
📋 TL;DR
CVE-2021-31584 is a Cross-Site Request Forgery (CSRF) vulnerability in Sipwise C5 NGCP's www_csc web interface that allows attackers to trick authenticated administrators into performing unauthorized actions. Attackers can exploit this to execute call/click2dial operations with administrative privileges. Organizations running affected Sipwise C5 NGCP versions are vulnerable.
💻 Affected Systems
- Sipwise C5 NGCP
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could perform unauthorized phone calls, manipulate call routing, modify system configurations, or potentially gain further access to the telephony system.
Likely Case
Unauthorized phone calls leading to toll fraud, call redirection, or manipulation of call handling rules.
If Mitigated
Limited impact if proper CSRF protections, network segmentation, and administrative access controls are implemented.
🎯 Exploit Status
Exploitation requires tricking an authenticated administrator into visiting a malicious webpage. Proof-of-concept code is publicly available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Platform versions after NGCP CE mr3.8.13
Vendor Advisory: http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/2021-September/014708.html
Restart Required: Yes
Instructions:
1. Update Sipwise C5 NGCP to version after mr3.8.13. 2. Apply vendor-provided patches. 3. Restart affected services. 4. Verify the fix by testing CSRF protections.
🔧 Temporary Workarounds
Implement CSRF Tokens
linuxAdd CSRF protection tokens to all administrative forms and validate them server-side.
Requires code modification to implement anti-CSRF tokens in the www_csc interface
Restrict Administrative Access
linuxLimit access to the www_csc interface to trusted networks and require VPN for remote administration.
iptables -A INPUT -p tcp --dport [www_csc_port] -s [trusted_network] -j ACCEPT
iptables -A INPUT -p tcp --dport [www_csc_port] -j DROP
🧯 If You Can't Patch
- Implement network segmentation to isolate the Sipwise C5 system from untrusted networks
- Require administrators to use separate browser sessions or incognito mode for administrative tasks
🔍 How to Verify
Check if Vulnerable:
Check if your Sipwise C5 NGCP version is between 3.6.4 and mr3.8.13 inclusive using the version check command.Check Version:
ngcp-versionVerify Fix Applied:
Test CSRF protection by attempting to submit administrative forms without proper CSRF tokens after patching.📡 Detection & Monitoring
Log Indicators:
- Unusual call patterns from administrative accounts
- Administrative actions from unexpected IP addresses
- Failed CSRF token validation attempts
Network Indicators:
- HTTP POST requests to www_csc endpoints without Referer headers or CSRF tokens
- Administrative actions originating from non-administrative networks
SIEM Query:
source="sipwise_logs" AND (event="call_initiated" OR event="config_change") AND user="admin" AND src_ip NOT IN [admin_networks]🔗 References
- http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/2021-September/014708.html
- http://packetstormsecurity.com/files/162318/Sipwise-C5-NGCP-CSC-Cross-Site-Request-Forgery.html
- https://www.sipwise.com
- https://www.zeroscience.mk/en/vulnerabilities
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5649.php
- http://lists.sipwise.com/pipermail/spce-user_lists.sipwise.com/2021-September/014708.html
- http://packetstormsecurity.com/files/162318/Sipwise-C5-NGCP-CSC-Cross-Site-Request-Forgery.html
- https://www.sipwise.com
- https://www.zeroscience.mk/en/vulnerabilities
- https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5649.php
