CVE-2025-1131: Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation
A local privilege escalation vulnerability exists in the safeasterisk script included with the Asterisk toolkit package. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating ownership or permissions.
Non-root users with legitimate write access to /etc/asterisk can exploit this behaviour by placing malicious scripts in the startup.d directory, which will then execute with root privileges upon service restart.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1131?
CVE-2025-1131 is categorized as a local privilege escalation vulnerability.
How does CVE-2025-1131 affect Asterisk installations?
CVE-2025-1131 affects Asterisk installations when the safe_asterisk script is used to start Asterisk as it allows unauthorized scripts to run with root privileges.
How can I mitigate CVE-2025-1131?
To mitigate CVE-2025-1131, ensure that the /etc/asterisk/startup.d/ directory is secured and review the scripts located there for any unauthorized changes.
Is there a patch available for CVE-2025-1131?
As of now, please check Asterisk's official channels for an update or patch addressing CVE-2025-1131.
Who is affected by CVE-2025-1131?
Any user of Asterisk running the safe_asterisk script within a SysV init or FreePBX environment is affected by CVE-2025-1131.