CVE-2024-42365highCWE-1220CWE-267

CVE-2024-42365: high-severity vulnerability in asterisk

Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan

Published · Updated

Follow this CVE+ Monitor asterisk+ Monitor asterisk

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

36Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendcvss 7.4epss 4.7%
from disclosure to weaponsame day
Published on NVDAug 8
metasploitAug 8
In short

Asterisk PBX allows users with basic 'originate' permission to modify configuration files and execute arbitrary code by manipulating dial plans and file operations, creating a serious security risk.

Technical detail

An authenticated AMI user with write=originate permission can leverage the FILE function within the SET application to append malicious content to Asterisk configuration files in /etc/asterisk/, and curl remote files to disk, enabling arbitrary code execution through dialplan manipulation (CWE-1220, CWE-267). This bypasses intended permission controls and requires only AMI access with limited originate privileges.

Summary generated and translated by AI from the official description.
Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with `write=originate` may change all configuration files in the `/etc/asterisk/` directory. This occurs because they are able to curl remote files and write them to disk, but are also able to append to existing files using the `FILE` function inside the `SET` application. This issue may result in privilege escalation, remote code execution and/or blind server-side request forgery with arbitrary protocol. Asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2 contain a fix for this issue.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Affected products
asterisk · asterisk
Related CVEs — asterisk

In the same product, most dangerous first.

CVE-2023-49294MEDIUMAsterisk Path Traversal vulnerabilityEPSS 45.3%CVE-2023-49786HIGHAsterisk susceptible to Denial of Service via DTLS Hello packets during call initiationEPSS 5.3%CVE-2026-57193MEDIUMAsterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)EPSS 2.0%CVE-2009-3723—CVE-2009-3723EPSS 1.2%CVE-2023-37457HIGHAsterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update'EPSS 1.1%CVE-2026-57200HIGHAsterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCEEPSS 0.9%