CVE-2024-57520

Executive Summary

CVE-2024-57520 describes an insecure permissions vulnerability in Asterisk v22, specifically within the action_createconfig function. The vulnerability allows a remote attacker to execute arbitrary code, though the vendor disputes this, stating the impact is limited to creating empty files outside the Asterisk product directory (directory traversal) and requires a privileged user with configuration management abilities. The CVSS score is 0.0, and the EPSS score is 0.0%, indicating low exploitation activity. No public proof-of-concept (PoC) or exploit code is available. The vulnerability is disputed, and no patch details are available.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the Asterisk open-source PBX software, which is typically distributed via source code or package managers like apt or yum. The supply chain risk is low, but users should verify the integrity of their Asterisk installation.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, which is unusual and likely indicates a placeholder or incomplete scoring. The vendor disputes the severity, limiting the impact to directory traversal and requiring privileged access. The threat level is considered Low due to the requirement for privileged access and the limited impact (creating empty files). However, if exploited in conjunction with other vulnerabilities, it could lead to more severe outcomes.

Deep Dive & Mechanics

The vulnerability resides in the action_createconfig function within Asterisk v22. This function is used to create configuration files. Due to insecure permissions, a remote attacker with privileged access (ability to manage configuration) can exploit this function to create files outside the intended Asterisk product directory. This is a classic directory traversal vulnerability (CWE-22). The attacker can specify a path that traverses up the directory tree, creating empty files in arbitrary locations on the filesystem.

The vendor disputes the "arbitrary code execution" claim, stating that only empty files can be created. However, creating empty files in sensitive locations (e.g., /etc/cron.d/, /tmp/) could be a stepping stone for further attacks, such as creating a cron job or overwriting a configuration file.

Vulnerable vs. Patched Code

No patched code is available. The vulnerable code is in the action_createconfig function. A secure implementation would validate the file path to ensure it stays within the Asterisk configuration directory. For example:

Vulnerable (pseudocode):

def action_createconfig(filename, content):
    path = "/etc/asterisk/" + filename
    with open(path, 'w') as f:
        f.write(content)

Patched (pseudocode):

import os
def action_createconfig(filename, content):
    base = "/etc/asterisk/"
    path = os.path.normpath(os.path.join(base, filename))
    if not path.startswith(base):
        raise Exception("Invalid path")
    with open(path, 'w') as f:
        f.write(content)

Exploitation & Lab Setup

Red Team

No public exploit code is available. To simulate the attack, a privileged user can use the Asterisk Manager Interface (AMI) to call the action_createconfig function with a malicious filename containing directory traversal sequences (e.g., ../../tmp/evil.txt). This will create an empty file in the /tmp/ directory.

Example AMI command:

Action: CreateConfig
Filename: ../../tmp/evil.txt
Content:

Blue Team

To detect exploitation attempts, monitor AMI logs for CreateConfig actions with suspicious filenames containing ../ or absolute paths. Also, monitor filesystem changes for unexpected empty files created outside the Asterisk configuration directory.

Indicators of Compromise (IOCs)

• File Creation Events: Unexpected empty files created in directories like /tmp/, /var/tmp/, /etc/cron.d/, or /home/.
• AMI Logs: Entries showing Action: CreateConfig with filenames containing ../ or absolute paths.
• Filesystem Changes: New files with zero size in unusual locations.

Detection Engineering

YARA Rule

rule Detect_Asterisk_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts in Asterisk CreateConfig action"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-57520"
    strings:
        $s1 = "CreateConfig" nocase
        $s2 = "../" nocase
        $s3 = "..\\" nocase
    condition:
        all of them
}

Sigma Rule

title: Asterisk CreateConfig Directory Traversal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects directory traversal attempts in Asterisk CreateConfig action
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-57520
logsource:
    product: asterisk
    service: manager
detection:
    selection:
        Action: "CreateConfig"
        Filename|contains: 
            - "../"
            - "..\\"
    condition: selection
falsepositives:
    - Legitimate use of absolute paths (unlikely)
level: high

Suricata Rule

alert tcp any any -> any 5038 (msg:"Asterisk AMI CreateConfig Directory Traversal"; flow:to_server,established; content:"Action|3a| CreateConfig"; content:"Filename|3a|"; content:"../"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Restrict AMI Access: Limit AMI access to trusted IP addresses and users. Use strong authentication.
2. Input Validation: Implement strict input validation for the Filename parameter in action_createconfig. Reject any path containing ../ or absolute paths.
3. Filesystem Permissions: Ensure the Asterisk user has minimal write permissions, only to the necessary configuration directory.
4. Monitor Logs: Enable and monitor AMI logs for suspicious CreateConfig actions.
5. Vendor Contact: Since no patch is available, contact the Asterisk vendor for a fix or consider disabling the CreateConfig action if not needed.

Valters IT
DevSecOps & Cyber Threat Intelligence