CVE-2023-37457

Executive Summary

CVE-2023-37457 is a memory-corruption vulnerability in the Asterisk open-source PBX, specifically within the PJSIP_HEADER dialplan function's update functionality. In affected versions — 18.20.0 and prior, 20.5.0 and prior, 21.0.0, and certified-asterisk 18.9-cert5 and prior — updating a SIP header with a value larger than the pre-allocated buffer can cause memory overwrite or a process crash. The vulnerability is rated high severity (CVSS 7.5) with a high availability impact, though it is not remotely exploitable unless the dialplan is explicitly written to use untrusted external data in the update call. A patch is available at commit a1ca0268254374b515fa5992f01340f7717113fa.

Technical Analysis

The flaw resides in the PJSIP_HEADER dialplan function's update mode. This function is designed to read, add, and modify SIP headers in a PJSIP session. When invoked with the update modifier, the function attempts to replace the value of an existing SIP header with a new value supplied in the dialplan.

The vulnerability mechanism is an out-of-bounds write (CWE-787). The code path that handles the update operation does not properly validate the buffer capacity before copying the new header value. If the new value exceeds the allocated buffer space for storing the header's value, the write operation overflows into adjacent memory regions. This can result in either:

1. Memory corruption — overwriting adjacent heap or stack structures, potentially leading to unstable system behavior or remote code execution if an attacker gains control of the corrupted data.
2. Process crash — the overwrite corrupts critical data structures, leading to a segmentation fault or abort within the Asterisk process.

The vulnerability is present in the PJSIP_HEADER dialplan function across all three major release lines (18.x, 20.x, 21.x) and the certified branch (18.9-cert). The code path is identical in all affected branches since the function logic was not modified between the offending commit and the patched version.

The NVD description explicitly states: "This is not externally exploitable, unless dialplan is explicitly written to update a header based on data from an outside source." This means the vulnerability's exploitability depends entirely on the dialplan author's use of untrusted data — such as SIP message content, database lookups, or web interface inputs — as the value argument to the PJSIP_HEADER function.

The root cause is a missing bounds check in the memory copy routine used to store the header value. Without validation of the incoming data length against the allocated buffer size, any caller — including automated dialplan logic — can trigger an overflow.

Exploitation Scenarios

Attack Chain Inference: The NVD description provides no public PoC, and the vendor does not classify this as externally exploitable in default configurations. The following attack chain is inferred from the vulnerability class (out-of-bounds write) and the described trigger condition.

Step 1 — Target Identification: An attacker targets an Asterisk PBX system that uses the PJSIP_HEADER dialplan function with the update option. Shodan searches for SIP endpoints or scans for public-facing Asterisk servers can identify candidate targets. The attacker would need prior knowledge of the dialplan logic or the ability to probe responses to infer whether the vulnerable function is in use.

Step 2 — Trigger Condition: The attacker must deliver a crafted payload through a channel that the dialplan feeds into the update call. Since the NVD description states the vulnerability only triggers when the dialplan uses outside data in the update, the attack surface is the data source feeding the header value. This could include:

• SIP message headers that are extracted and re-injected via PJSIP_HEADER
• Database fields read by the dialplan (e.g., via ODBC or AstDB)
• HTTP requests processed by an external application that writes to a database consumed by the dialplan

Step 3 — Payload Execution: The attacker crafts the chosen input channel with a value exceeding the buffer capacity. For example, if the dialplan code reads a SIP header value (e.g., a caller-provided SIP header) and passes it to PJSIP_HEADER(...):update=...), a SIP INVITE with an oversized header field value would cause the overflow. Alternatively, if the data comes from a database, the attacker could inject a large value via a web frontend or SQL injection into the field that the dialplan reads.

Step 4 — Post-Exploitation Impact: The overflow corrupts adjacent memory, crashing the Asterisk process (high availability impact). In a worst-case scenario where the attacker understands the memory layout, the overflow could be weaponized for arbitrary code execution within the Asterisk process context. However, the NVD description only confirms crash/memory-overwrite as the confirmed impact; remote code execution remains theoretical without additional research.

No public PoC is available; this attack chain is inferred from the vulnerability class. Public SIP endpoints running vulnerable Asterisk versions are the most likely targets, but the requirement for explicit dialplan usage significantly reduces the real-world attack surface.

Impact Assessment

Business Impact: A successful exploitation results in a denial-of-service condition for the PBX system. Telephony services — inbound call routing, voicemail, conferencing, and IVR — would be interrupted. For organizations that depend on Asterisk as their primary voice infrastructure, this constitutes a critical business disruption.

Affected Systems: All Asterisk deployments using PJSIP_HEADER with the update flag. This includes:

• Asterisk 18.20.0 and prior
• Asterisk 20.5.0 and prior
• Asterisk 21.0.0
• certified-asterisk 18.9-cert5 and prior

Blast Radius: High availability impact per the CVSS 3.1 vector (CA:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The attack requires network access (AV:N) and no privileges (PR:N). However, the user interaction requirement (UI:N) and the prerequisite that dialplan must be explicitly written to use external data narrows the practical exploitability.

CVSS Rationale: The 7.5 score reflects the ease of triggering the overflow (network-accessible, no authentication) combined with the high availability impact. Confidentiality and integrity are scored as N since the NVD description does not specify data exposure or modification.

Detection Guidance

Sigma Rule

title: Asterisk PJSIP_HEADER Update Buffer Overflow Attempt
id: 8f2b3c4d-5e6a-4f8b-9c0d-1a2b3c4d5e6f
status: experimental
description: Detects Asterisk process crashes or errors related to PJSIP_HEADER update overflow conditions.
logsource:
    product: asterisk
    service: asterisk
detection:
    selection_main:
        EventID: 'CRITICAL'
        Message|contains|all:
            - 'pjsip'
            - 'header'
            - 'malloc'
            - 'corrupt'
    selection_segv:
        Message|contains: 'Segmentation fault'
    condition: selection_main or selection_segv
falsepositives:
    - Normal Asterisk crashes unrelated to this CVE
level: high

YARA Rule

rule Asterisk_PJSIP_Header_Overflow
{
    meta:
        author = "Valters IT Security"
        description = "Detects strings in Asterisk binaries associated with PJSIP_HEADER update buffer handling"
        date = "2023-11-01"
        cve = "CVE-2023-37457"
    strings:
        $s1 = "PJSIP_HEADER" ascii wide
        $s2 = "update" ascii wide
        $s3 = "ast_str_set" ascii wide
        $s4 = "pj_strdup" ascii wide
    condition:
        any of ($s1, $s2) and any of ($s3, $s4) and filesize < 50MB
}

Suricata IDS Rule

alert sip any any -> any any (msg:"CVE-2023-37457 Asterisk PJSIP_HEADER update crash attempt"; content:"INVITE"; nocase; content:"PJSIP_HEADER"; nocase; pcre:"/Content-Length:\s*\d{6,}/"; classtype:attempted-dos; sid:20233745; rev:1;)

Elastic Detection

process where event.action == "crash" and
  process.name == "asterisk" and
  (message : "*Segmentation fault*" or message : "*pjsip*header*" or message : "*memory corruption*")

Explanation: This EQL rule queries Elastic Endpoint or Auditbeat data for Asterisk process crashes containing strings related to the PJSIP header processing or memory corruption. Adjust index patterns if crash data is stored elsewhere (e.g., journald, syslog).

Splunk SPL Query

index=main sourcetype=asterisk OR sourcetype=syslog
    (error OR critical OR fatal)
    AND (pjsip OR PJSIP_HEADER)
    AND (corrupt OR overflow OR segfault OR crash)
    | table _time, host, source, message
    | where match(message, "(?i)(corrupt|overflow|segfault|crash)")

Wazuh OSSEC Rule

<group name="asterisk, cve-2023-37457,">
  <rule id="100374" level="12">
    <decoded_as>syslog</decoded_as>
    <match>PJSIP_HEADER|pjsip</match>
    <match>corrupt|overflow|segfault|crash</match>
    <description>Asterisk PJSIP_HEADER buffer overflow or crash detected (CVE-2023-37457)</description>
    <group>asterisk_dos,pci_dss_11.4,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — two independent sources (CNA and Debian) confirm the fix at commit a1ca0268254374b515fa5992f01340f7717113fa.

1) Immediate Mitigations (if patching is not immediately possible):

• If PJSIP_HEADER is used in your dialplan without the update modifier, the vulnerability is not present per the NVD description. Verify all PJSIP_HEADER usage via an audit of dialplan files (extensions.conf, etc.).
• If the update modifier is used, review the source of the value argument. Only allow data from trusted internal sources and sanitize/limit size of any external input.
• Restrict network access to the SIP interfaces (UDP/TCP 5060-5061) using firewall rules to trusted networks only. This reduces the possibility of remote SIP-based payload delivery.
• Monitor Asterisk logs for abnormal crash patterns.

2) Patch/Upgrade Steps:

• Upgrade to Asterisk version 20.5.1 or later (if on 20.x).
• Upgrade to Asterisk version 18.20.1 or later (if on 18.x).
• Upgrade to certified-asterisk 18.9-cert6 or later (certified branch).
• For 21.0.0 users: upgrade to a newer minor release once available; consult the vendor advisory or Git history for the specific patched version.
• If source-based deployment is used, apply the patch commit a1ca0268254374b515fa5992f01340f7717113fa directly.
• Verify dialplan behavior post-upgrade, particularly around PJSIP_HEADER calls.

3) Long-Term Hardening:

• Audit all dialplan functions that accept external data (SIP headers, database values, HTTP inputs) and enforce strict length validation at the application layer.
• Use Asterisk's MAX_HEADER_LEN or equivalent configuration directives if available to constrain header sizes.
• Implement network segmentation to isolate VoIP infrastructure from untrusted networks.
• Deploy an IPS with custom rules matching known Asterisk memory-corruption patterns to complement signature-based detection.
• Maintain an active update cadence for Asterisk security patches.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2023-37457
2. Vendor Advisory (Asterisk Project): https://github.com/asterisk/asterisk (connection failed — verify manually)/commit/a1ca0268254374b515fa5992f01340f7717113fa — patch commit
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2023-37457 — independent confirmation of fix
4. Asterisk Official Website: https://www.asterisk.org — for release notes on patched versions (18.20.1, 20.5.1, and certified updates)

Threat Actor Campaigns: No known in-the-wild exploitation campaigns have been reported for CVE-2023-37457 at the time of this report. The EPSS percentile (63.3%) suggests elevated, but not critical, exploitation likelihood. CISA has not added this CVE to the Known Exploited Vulnerabilities catalog.

Note on Shodan Dorks: The dorks provided above are generic Asterisk identifiers for discovering potentially affected SIP endpoints. These are sampling dorks — the presence of an Asterisk SIP server does not confirm vulnerability, since the vulnerable code path only triggers with specific dialplan configurations.