high
8.8
CWE
267 1220
Advisory Published
Updated

CVE-2024-42365: Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan

First published: Thu Aug 08 2024(Updated: )

Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with `write=originate` may change all configuration files in the `/etc/asterisk/` directory. This occurs because they are able to curl remote files and write them to disk, but are also able to append to existing files using the `FILE` function inside the `SET` application. This issue may result in privilege escalation, remote code execution and/or blind server-side request forgery with arbitrary protocol. Asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2 contain a fix for this issue.

Credit: security-advisories@github.com

Affected SoftwareAffected VersionHow to fix
Asterisk<18.24.2
Asterisk>=19.0.0<20.9.1
Asterisk=21.4.0
Asterisk=13.13.0
Asterisk=13.13.0-cert1
Asterisk=13.13.0-cert1-rc1
Asterisk=13.13.0-cert1-rc2
Asterisk=13.13.0-cert1-rc3
Asterisk=13.13.0-cert1-rc4
Asterisk=13.13.0-cert2
Asterisk=13.13.0-cert3
Asterisk=13.13.0-rc1
Asterisk=13.13.0-rc2
Asterisk=16.8-cert1-rc1
Asterisk=16.8-cert1-rc2
Asterisk=16.8-cert1-rc3
Asterisk=16.8-cert1-rc4
Asterisk=16.8-cert1-rc5
Asterisk=16.8-cert10
Asterisk=16.8-cert11
Asterisk=16.8-cert12
Asterisk=16.8-cert13
Asterisk=16.8-cert14
Asterisk=16.8-cert4-rc1
Asterisk=16.8-cert4-rc2
Asterisk=16.8-cert4-rc3
Asterisk=16.8-cert4-rc4
Asterisk=16.8.0
Asterisk=16.8.0-cert1
Asterisk=16.8.0-cert10
Asterisk=16.8.0-cert11
Asterisk=16.8.0-cert12
Asterisk=16.8.0-cert2
Asterisk=16.8.0-cert3
Asterisk=16.8.0-cert4
Asterisk=16.8.0-cert5
Asterisk=16.8.0-cert6
Asterisk=16.8.0-cert7
Asterisk=16.8.0-cert8
Asterisk=16.8.0-cert9
Asterisk=18.9-cert1
Asterisk=18.9-cert1-rc1
Asterisk=18.9-cert10
Asterisk=18.9-cert2
Asterisk=18.9-cert3
Asterisk=18.9-cert4
Asterisk=18.9-cert5
Asterisk=18.9-cert6
Asterisk=18.9-cert7
Asterisk=18.9-cert8
Asterisk=18.9-cert8-rc1
Asterisk=18.9-cert8-rc2
Asterisk=18.9-cert9
Asterisk=20.7-cert1
Asterisk=20.7-cert1-rc1
Asterisk=20.7-cert1-rc2

Remedy

https://github.com/asterisk/asterisk/commit/42a2f4ccfa2c7062a15063e765916b3332e34cc4

Remedy

https://github.com/asterisk/asterisk/commit/7a0090325bfa9d778a39ae5f7d0a98109e4651c8

Remedy

https://github.com/asterisk/asterisk/commit/b4063bf756272254b160b6d1bd6e9a3f8e16cc71

Remedy

https://github.com/asterisk/asterisk/commit/bbe68db10ab8a80c29db383e4dfe14f6eafaf993

Remedy

https://github.com/asterisk/asterisk/commit/faddd99f2b9408b524e5eb8a01589fe1fa282df2

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2024-42365?

    CVE-2024-42365 has a critical severity rating due to the potential for an AMI user to modify system configuration files.

  • How do I fix CVE-2024-42365?

    To fix CVE-2024-42365, upgrade to Asterisk versions 18.24.2, 20.9.2, 21.4.2, or the respective certified versions.

  • Which versions of Asterisk are affected by CVE-2024-42365?

    Asterisk versions prior to 18.24.2, between 19.0.0 and 20.9.1, and 21.4.0 are affected by CVE-2024-42365.

  • What impact does CVE-2024-42365 have on Asterisk users?

    CVE-2024-42365 allows unauthorized AMI users with 'write=originate' permissions to change configuration files, leading to potential system compromise.

  • Is there a workaround for CVE-2024-42365?

    A temporary workaround for CVE-2024-42365 is to restrict AMI access and ensure proper authentication for users while upgrading is planned.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203