CVE-2021-37441
📋 TL;DR
CVE-2021-37441 is a path traversal vulnerability in NCH Axon PBX that allows attackers to delete arbitrary files on the system by manipulating the logdelete parameter. This affects all installations of NCH Axon PBX version 2.22 and earlier. Attackers can potentially delete critical system files, leading to denial of service or system compromise.
💻 Affected Systems
- NCH Axon PBX
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical operating system files, leading to permanent data loss and extended service downtime.
Likely Case
Denial of service by deleting PBX configuration files, call logs, or system logs, disrupting telephony services.
If Mitigated
Limited impact if proper file permissions and access controls prevent deletion of critical files.
🎯 Exploit Status
Exploitation requires only web access to the PBX interface. The vulnerability is in the logdelete parameter which accepts path traversal sequences.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.23 or later
Vendor Advisory: https://www.nch.com.au/pbx/index.html
Restart Required: Yes
Instructions:
1. Download latest version from NCH website. 2. Backup current configuration. 3. Install update. 4. Restart Axon PBX service. 5. Verify version is 2.23 or higher.
🔧 Temporary Workarounds
Web Application Firewall Rule
allBlock requests containing path traversal sequences in the logdelete parameter
WAF rule: Block if request_uri contains 'logdelete?file=/..'
Access Restriction
linuxRestrict access to Axon PBX web interface to trusted IP addresses only
iptables -A INPUT -p tcp --dport [AXON_PORT] -s [TRUSTED_IP] -j ACCEPT
iptables -A INPUT -p tcp --dport [AXON_PORT] -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Axon PBX from untrusted networks
- Enable detailed logging and monitoring for file deletion attempts via the web interface
🔍 How to Verify
Check if Vulnerable:
Check if Axon PBX version is 2.22 or earlier via web interface admin panel or system informationCheck Version:
Check web interface at http://[axon-ip]:[port]/admin or check installed program versionVerify Fix Applied:
Verify version is 2.23 or higher and test that logdelete parameter no longer accepts path traversal sequences📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing 'logdelete?file=/..' in access logs
- Unexpected file deletion events in system logs
Network Indicators:
- HTTP POST/GET requests to /logdelete endpoint with suspicious file parameters
SIEM Query:
source="axon_access.log" AND "logdelete?file=/.."