CVE-2024-42365
📋 TL;DR
This vulnerability allows authenticated Asterisk Manager Interface (AMI) users with 'write=originate' permissions to modify configuration files in /etc/asterisk/ directory. Attackers can write or append to files via the FILE function in SET application, potentially leading to privilege escalation or remote code execution. Affects Asterisk PBX systems with vulnerable versions and AMI users with specific permissions.
💻 Affected Systems
- Asterisk
- Certified Asterisk
📦 What is this software?
Asterisk by Asterisk
Asterisk by Asterisk
Asterisk by Asterisk
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via remote code execution leading to complete control of the Asterisk server, data exfiltration, and lateral movement within the network.
Likely Case
Privilege escalation allowing attackers to modify Asterisk configuration to enable unauthorized call routing, eavesdropping, or further system exploitation.
If Mitigated
Limited impact if proper access controls restrict AMI users and network exposure, though configuration file corruption could still cause service disruption.
🎯 Exploit Status
Exploitation requires authenticated AMI access with specific permissions. The vulnerability is in the SET application's FILE function handling.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Asterisk 18.24.2, 20.9.2, 21.4.2; Certified Asterisk 18.9-cert11, 20.7-cert2
Vendor Advisory: https://github.com/asterisk/asterisk/security/advisories
Restart Required: Yes
Instructions:
1. Backup current configuration and data. 2. Update Asterisk to patched version using package manager or source compilation. 3. Restart Asterisk service. 4. Verify version and test functionality.
🔧 Temporary Workarounds
Restrict AMI User Permissions
linuxRemove 'write=originate' permission from AMI users who don't require it in manager.conf
Edit /etc/asterisk/manager.conf and modify or remove 'write = originate' from user definitions
Network Access Control
linuxRestrict AMI interface access to trusted IP addresses only
Edit /etc/asterisk/manager.conf and add 'permit=' lines with specific IP addresses
🧯 If You Can't Patch
- Remove 'write=originate' permission from all AMI users in manager.conf file
- Implement network segmentation to isolate Asterisk server and restrict AMI access to management network only
🔍 How to Verify
Check if Vulnerable:
Check Asterisk version and compare with affected versions. Review manager.conf for users with 'write=originate' permission.Check Version:
asterisk -VVerify Fix Applied:
Verify Asterisk version is patched and test that FILE function in SET application no longer allows file writes to /etc/asterisk/📡 Detection & Monitoring
Log Indicators:
- Unusual AMI authentication attempts
- SET application calls with FILE function targeting /etc/asterisk/
- Configuration file modification timestamps
Network Indicators:
- AMI traffic from unexpected sources
- Unusual patterns in AMI command sequences
SIEM Query:
source="asterisk.log" AND ("SET" AND "FILE" AND "/etc/asterisk/")🔗 References
- https://github.com/asterisk/asterisk/blob/14367caaf7241df1eceea7c45c5b261989c2c6db/main/manager.c#L6426
- https://github.com/asterisk/asterisk/blob/7d28165cb1b2d02d66e8693bd3fe23ee72fc55d8/main/manager.c#L6426
- https://github.com/asterisk/asterisk/commit/42a2f4ccfa2c7062a15063e765916b3332e34cc4
- https://github.com/asterisk/asterisk/commit/7a0090325bfa9d778a39ae5f7d0a98109e4651c8
- https://github.com/asterisk/asterisk/commit/b4063bf756272254b160b6d1bd6e9a3f8e16cc71
- https://github.com/asterisk/asterisk/commit/bbe68db10ab8a80c29db383e4dfe14f6eafaf993
- https://github.com/asterisk/asterisk/commit/faddd99f2b9408b524e5eb8a01589fe1fa282df2
- https://github.com/asterisk/asterisk/security/advisories/GHSA-c4cg-9275-6w44
- https://lists.debian.org/debian-lts-announce/2024/10/msg00016.html
