CVE-2024-42365
Asterisk
CVE-2024-42365 is a critical vulnerability in Asterisk, an open-source PBX and telephony toolkit, allowing an AMI user with write=originate privileges to modify configuration files. This vulnerability stems from the ability to use curl to fetch remote files and the FILE function to append to existing files within the /etc/asterisk/ directory. The risk includes potential privilege escalation, remote code execution, and blind server-side request forgery. While the CVSS score is 8.8 indicating high severity, the SOCRadar Vulnerability Risk Score (SVRS) is 30, suggesting a lower level of immediate threat compared to vulnerabilities with SVRS scores above 80. Organizations using vulnerable Asterisk versions should upgrade to versions 18.24.2, 20.9.2, 21.4.2, 18.9-cert11, or 20.7-cert2 to mitigate this risk. Although the SVRS is relatively low, the potential impact is severe and warrants prompt attention to prevent exploitation. The ability to manipulate configuration files provides attackers with a significant foothold within the system.
Description
CVE-2024-42365 is a vulnerability in Asterisk, an open-source PBX and telephony toolkit. It allows an AMI user with write=originate to change all configuration files in the /etc/asterisk/ directory, leading to privilege escalation, remote code execution, or blind server-side request forgery with arbitrary protocol. The SVRS for this CVE is 34, indicating a moderate risk.
Key Insights
- Privilege Escalation: The vulnerability allows an attacker to gain elevated privileges on the target system, potentially leading to complete control.
- Remote Code Execution: An attacker can execute arbitrary code on the vulnerable system, allowing them to install malware, steal data, or disrupt operations.
- Blind Server-Side Request Forgery: The vulnerability can be exploited to forge requests on behalf of the server, potentially leading to unauthorized actions or data breaches.
Mitigation Strategies
- Update Asterisk: Upgrade to Asterisk versions 18.24.2, 20.9.2, or 21.4.2, or certified-asterisk versions 18.9-cert11 or 20.7-cert2, which contain a fix for this issue.
- Restrict AMI Access: Limit access to the AMI interface to only authorized users and implement strong authentication mechanisms.
- Monitor for Suspicious Activity: Monitor logs and network traffic for any suspicious activity that may indicate exploitation of this vulnerability.
- Implement Intrusion Detection and Prevention Systems: Deploy intrusion detection and prevention systems to detect and block malicious activity targeting this vulnerability.
Additional Information
- Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
- Exploit Status: Active exploits have been published.
- CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of this vulnerability, calling for immediate and necessary measures.
- In the Wild: The vulnerability is actively exploited by hackers.
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.