CVE-2024-42365 Overview
Asterisk is an open source private branch exchange (PBX) and telephony toolkit widely deployed for VoIP infrastructure. CVE-2024-42365 affects the Asterisk Manager Interface (AMI) and allows authenticated users with the write=originate permission to modify any configuration file in the /etc/asterisk/ directory. The flaw combines two AMI-exposed capabilities: fetching remote files via curl and appending arbitrary content to files through the FILE function inside the SET application. Attackers can leverage this behavior to achieve privilege escalation, remote code execution, and blind server-side request forgery (SSRF) with arbitrary protocols. The issue is classified under [CWE-267] (Privilege Defined With Unsafe Actions).
Critical Impact
An AMI user granted only the originate privilege can rewrite Asterisk configuration files, execute arbitrary code, and pivot into internal networks through blind SSRF over multiple protocols.
Affected Products
- Asterisk versions prior to 18.24.2, 20.9.2, and 21.4.2
- Certified-Asterisk 18.9 prior to cert11
- Certified-Asterisk 20.7 prior to cert2
Discovery Timeline
- 2024-08-08 - CVE-2024-42365 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-42365
Vulnerability Analysis
The Asterisk Manager Interface (AMI) exposes administrative operations through granular permission classes. The originate permission is intended to let an AMI user initiate outbound calls and channels, not to modify server state. In vulnerable releases, however, the Originate action can be combined with dialplan applications such as System, SET, and the FILE function to interact with the local filesystem. The curl dialplan function fetches remote content, while the FILE function inside SET writes or appends that content to a target path. Chained together, an attacker with write=originate can drop new configuration files or append directives to existing ones under /etc/asterisk/. This effectively grants filesystem write access far beyond the intent of the originate role, described in [CWE-267].
Root Cause
The root cause is an overly broad privilege boundary in AMI. The originate class allows execution of dialplan primitives that can read remote URLs and write to arbitrary local files. No path allowlist restricts writes to safe directories, and no separation exists between telephony operations and filesystem operations. Reviewers can inspect the pre-patch behavior in the Asterisk manager.c source.
Attack Vector
An authenticated AMI user submits an Originate action referencing an in-line dialplan or a context that invokes curl to retrieve attacker-controlled content, then uses SET(FILE(/etc/asterisk/<target>.conf)=...) to append that content. Modifying files such as manager.conf, extensions.conf, or module configurations can escalate the AMI user to full administrative control, execute code via loaded modules, or trigger outbound requests to internal services for blind SSRF. The vulnerability is reachable over the network wherever AMI is exposed.
Synthetic exploitation code is not published here. See the Asterisk security advisory GHSA-c4cg-9275-6w44 for vendor-provided technical detail.
Detection Methods for CVE-2024-42365
Indicators of Compromise
- Unexpected modifications, new lines, or timestamps on files in /etc/asterisk/, particularly manager.conf, extensions.conf, and modules.conf.
- AMI Originate actions from accounts with only write=originate that reference curl(, FILE(, or SET(FILE(... in Application, Data, or dialplan variables.
- Outbound network connections from the Asterisk host to unknown URLs correlated with AMI login events.
- New or unfamiliar accounts appearing in manager.conf after AMI activity.
Detection Strategies
- Enable and centralize Asterisk full logging (logger.conf) and AMI event logs, then alert on Originate actions that reference filesystem functions.
- Deploy file integrity monitoring on /etc/asterisk/ to flag any unauthorized change.
- Correlate AMI authentication events with process, network, and file activity using an EDR or SIEM to surface suspicious sequences.
Monitoring Recommendations
- Baseline expected AMI clients by source IP and account, and alert on deviations.
- Monitor for outbound egress from the PBX to non-telephony destinations, especially internal RFC1918 ranges that could indicate SSRF.
- Track loading of unexpected modules or dialplan reloads shortly after AMI sessions.
How to Mitigate CVE-2024-42365
Immediate Actions Required
- Upgrade to Asterisk 18.24.2, 20.9.2, or 21.4.2, or Certified-Asterisk 18.9-cert11 or 20.7-cert2.
- Audit manager.conf for accounts with write=originate and remove any that are not strictly required.
- Restrict AMI network exposure to trusted management networks only; never expose port 5038/tcp to the internet.
- Rotate AMI credentials and review /etc/asterisk/ for unauthorized modifications following the upgrade.
Patch Information
The fix is delivered in the upstream commits 42a2f4c, 7a00903, b4063bf, bbe68db, and faddd99. Distribution packages are also available; Debian users should apply the update described in the Debian LTS announcement. Full advisory context is in GHSA-c4cg-9275-6w44.
Workarounds
- Bind the AMI listener to 127.0.0.1 and require SSH tunneling or VPN for remote administration.
- Apply strict permit=/deny= ACLs in manager.conf to constrain AMI source addresses.
- Remove the originate write class from any AMI user that does not require call origination.
- Run Asterisk under a dedicated unprivileged account and enforce filesystem ACLs on /etc/asterisk/ so the service can read but not write configuration files at runtime.
# Configuration example: hardened AMI account in /etc/asterisk/manager.conf
[general]
enabled = yes
port = 5038
bindaddr = 127.0.0.1
[dialer]
secret = <strong-random-secret>
deny = 0.0.0.0/0
permit = 10.0.0.0/24
read = call,cdr
write = call
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
