CVE-2025-47780

Executive Summary

CVE-2025-47780 is a security advisory affecting Asterisk, an open-source PBX platform. The vulnerability lies in the cli_permissions.conf configuration file, which is intended to restrict shell command execution via the Asterisk CLI. Due to a logic flaw, the deny=!* directive (designed to block all shell commands) fails to enforce the restriction, allowing an authenticated administrator to execute arbitrary shell commands despite the configured deny rule. This bypass undermines the intended security controls and could lead to unauthorized command execution, privilege escalation, or system compromise.

Impact: An authenticated administrator with CLI access can bypass configured restrictions to run shell commands, potentially leading to full system compromise.

Affected Ecosystem: Asterisk PBX (open-source telephony platform).

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a core configuration issue in the Asterisk software itself. No supply chain implications are present.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (Not officially assigned)
• Attack Vector: Local (requires authenticated CLI access)
• Attack Complexity: Low
• Privileges Required: High (administrator)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: High (due to potential for full system compromise if exploited by an insider or compromised admin account)

Deep Dive & Mechanics

The vulnerability originates from improper handling of the cli_permissions.conf file. The configuration is designed to allow or deny specific CLI commands, including shell execution. The deny=!* directive is intended to block all shell commands. However, due to a parsing or logic error, the deny rule is not applied correctly, allowing shell commands to execute.

Root Cause: The Asterisk CLI permission system fails to properly evaluate the deny=!* rule, likely due to a flaw in the pattern matching or rule evaluation logic. This allows an authenticated user to bypass the restriction and run shell commands.

Attack Vector: An attacker with administrative CLI access (e.g., via SSH, console, or AMI) can issue shell commands (e.g., !ls, !whoami) that should be blocked but are allowed due to the bypass.

Impact: Successful exploitation allows arbitrary command execution on the underlying operating system, leading to data exfiltration, malware installation, or lateral movement.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable permission check
if (cli_permissions_enabled) {
    if (rule_matches(command, deny_rules)) {
        return DENY;
    }
    // Missing check for shell commands
    if (is_shell_command(command)) {
        // Should be denied but is allowed due to logic flaw
        return ALLOW;
    }
}

Patched Code (Conceptual):

// Pseudocode for patched permission check
if (cli_permissions_enabled) {
    if (rule_matches(command, deny_rules)) {
        return DENY;
    }
    // Explicitly check shell commands against deny rules
    if (is_shell_command(command) && !rule_matches(command, allow_rules)) {
        return DENY;
    }
}

Key Difference: The patched version ensures that shell commands are explicitly evaluated against the deny rules, preventing bypass.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to an Asterisk CLI (e.g., via asterisk -r or AMI).
• Administrative credentials or a user with CLI permissions.

Steps:

1. Connect to the Asterisk CLI:

   asterisk -r
   

2. Attempt to execute a shell command:

   !ls -la /etc
   

3. If the vulnerability is present, the command will execute despite deny=!* being configured.

Note: No public exploit code is available. This is a configuration bypass, not a remote exploit.

Blue Team (Detection & Hardening)

Detection:

• Monitor Asterisk CLI logs for unexpected shell command execution.
• Audit cli_permissions.conf for misconfigurations.

Hardening:

• Upgrade to patched versions immediately.
• Restrict CLI access to trusted administrators only.
• Use network segmentation to limit access to Asterisk management interfaces.

Indicators of Compromise (IOCs)

• Log Entries: Asterisk logs showing shell command execution (e.g., !ls, !whoami) despite deny rules.
• Configuration: cli_permissions.conf containing deny=!* but shell commands still allowed.
• Process Anomalies: Unexpected child processes spawned by Asterisk (e.g., /bin/sh, /bin/bash).

Detection Engineering

YARA Rule

rule CVE_2025_47780_Asterisk_CLI_Bypass {
    meta:
        description = "Detects attempts to exploit CVE-2025-47780 by looking for shell command execution in Asterisk CLI logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47780"
    strings:
        $shell_cmd = /![\w\/\-\s]+/  // Matches shell commands like !ls, !whoami
        $deny_rule = "deny=!*"
    condition:
        $shell_cmd and #deny_rule > 0
}

Sigma Rule

title: Asterisk CLI Shell Command Execution Bypass
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects shell command execution in Asterisk CLI logs despite deny rules
author: Valters IT
date: 2025-04-10
references:
    - CVE-2025-47780
logsource:
    product: asterisk
    service: cli
detection:
    selection:
        EventID: CLI_COMMAND
        Command|startswith: '!'
    condition: selection
falsepositives:
    - Legitimate administrative use if deny rules are not configured
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-47780 Asterisk CLI Shell Command Bypass"; flow:to_server,established; content:"!ls"; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Asterisk to versions 18.26.2, 20.14.1, 21.9.1, 22.4.1 or certified-asterisk to 18.9-cert14, 20.7-cert5.
2. Review and audit cli_permissions.conf to ensure deny rules are correctly applied.
3. Restrict CLI access to trusted administrators only.

Long-term Measures:

• Implement network segmentation for Asterisk management interfaces.
• Enable logging and monitoring for CLI commands.
• Regularly review and test permission configurations.

Workaround: If patching is not immediately possible, disable shell command execution entirely by removing the ! prefix from allowed commands in cli_permissions.conf and restarting Asterisk.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert