CVE-2026-23741
📋 TL;DR
Asterisk's ast_coredumper script runs with root privileges and sources a configuration file that can be modified by the asterisk user. This allows an attacker with write access to the asterisk user account to execute arbitrary code as root when the script runs. Affects Asterisk installations prior to patched versions.
💻 Affected Systems
- Asterisk
📦 What is this software?
Asterisk by Sangoma
Asterisk by Sangoma
Asterisk by Sangoma
Asterisk by Sangoma
⚠️ Risk & Real-World Impact
Worst Case
Full root compromise of the Asterisk server, allowing complete system takeover, data exfiltration, and lateral movement.
Likely Case
Privilege escalation from asterisk user to root, enabling installation of backdoors, modification of system files, and persistence.
If Mitigated
Limited to asterisk user compromise if proper file permissions and user isolation are implemented.
🎯 Exploit Status
Requires write access to asterisk user account. Exploitation is straightforward once that access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, or 23.2.2
Vendor Advisory: https://github.com/asterisk/asterisk/security/advisories/GHSA-rvch-3jmx-3jf3
Restart Required: No
Instructions:
1. Identify your Asterisk version. 2. Upgrade to patched version: 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, or 23.2.2. 3. Verify the fix by checking version and file permissions.
🔧 Temporary Workarounds
Restrict file permissions
linuxRemove write permissions for asterisk user on the configuration file
chmod 640 /etc/asterisk/ast_debug_tools.conf
chown root:asterisk /etc/asterisk/ast_debug_tools.conf
Remove vulnerable script
linuxDelete or disable the ast_coredumper script if not needed
rm /usr/sbin/ast_coredumper
chmod 000 /usr/sbin/ast_coredumper
🧯 If You Can't Patch
- Restrict asterisk user permissions to prevent write access to /etc/asterisk directory
- Implement strict access controls and monitoring for asterisk user account
🔍 How to Verify
Check if Vulnerable:
Check Asterisk version and verify ast_coredumper script exists with root permissions: ls -la /usr/sbin/ast_coredumperCheck Version:
asterisk -V | grep 'Asterisk'Verify Fix Applied:
Confirm Asterisk version is patched and /etc/asterisk/ast_debug_tools.conf has proper permissions (not writable by asterisk user)📡 Detection & Monitoring
Log Indicators:
- Unexpected execution of ast_coredumper script
- Modifications to /etc/asterisk/ast_debug_tools.conf file
Network Indicators:
- None specific to this vulnerability
SIEM Query:
process.name:"ast_coredumper" OR file.path:"/etc/asterisk/ast_debug_tools.conf" AND event.action:"modify"