CVE-2022-24629
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on AudioCodes Device Manager Express servers via directory traversal in file upload functionality. Attackers can upload PHP files to a specific directory, leading to complete system compromise. All systems running affected versions are vulnerable.
💻 Affected Systems
- AudioCodes Device Manager Express
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining root/admin privileges, data exfiltration, lateral movement, and persistent backdoor installation.
Likely Case
Web server compromise leading to data theft, service disruption, and use as pivot point for internal network attacks.
If Mitigated
Limited impact if proper network segmentation, file upload restrictions, and web application firewalls are in place.
🎯 Exploit Status
Exploitation is trivial with publicly available proof-of-concept code. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 7.8.20002.47752
Vendor Advisory: https://www.audiocodes.com/security-advisories
Restart Required: Yes
Instructions:
1. Download latest version from AudioCodes support portal. 2. Backup current configuration. 3. Install update following vendor documentation. 4. Restart services. 5. Verify fix by checking version.
🔧 Temporary Workarounds
Block access to vulnerable endpoint
allRestrict access to BrowseFiles.php via web server configuration or firewall rules
# Apache: RewriteRule ^/WebAdmin/admin/AudioCodes_files/ajax/BrowseFiles\.php - [F,L]
# Nginx: location ~ /WebAdmin/admin/AudioCodes_files/ajax/BrowseFiles\.php { deny all; }
Disable PHP execution in upload directory
allPrevent PHP file execution in the vulnerable directory
# Apache: <Location /WebAdmin/admin/AudioCodes_files/ajax> php_flag engine off </Location>
# Nginx: location ~ /WebAdmin/admin/AudioCodes_files/ajax/.*\.php$ { deny all; }
🧯 If You Can't Patch
- Isolate the server in a dedicated network segment with strict firewall rules
- Implement web application firewall with rules blocking directory traversal and PHP file uploads
🔍 How to Verify
Check if Vulnerable:
Check if BrowseFiles.php exists at /WebAdmin/admin/AudioCodes_files/ajax/ and test for directory traversal in dir parameterCheck Version:
Check web interface or configuration files for version informationVerify Fix Applied:
Attempt exploitation with known PoC - should fail. Verify version is >7.8.20002.47752📡 Detection & Monitoring
Log Indicators:
- HTTP requests to BrowseFiles.php with ../ in parameters
- File uploads to /WebAdmin/admin/AudioCodes_files/ajax/ directory
- PHP file creation in unexpected locations
Network Indicators:
- POST requests to BrowseFiles.php with file uploads
- Unusual outbound connections from the server
SIEM Query:
source="web_server" AND (uri="*BrowseFiles.php*" AND (param="*../*" OR file_upload="true"))