CVE-2024-57520: Sangoma Asterisk RCE Vulnerability

CVE-2024-57520 Overview

CVE-2024-57520 is an Insecure Permissions vulnerability in Sangoma Asterisk v22 that allows a remote attacker to execute arbitrary code via the action_createconfig function. This vulnerability enables directory traversal attacks where an authenticated attacker can create empty files outside of the Asterisk product directory.

Important Note: This CVE is disputed by the vendor. Sangoma contends that the impact is limited to creating empty files outside of the Asterisk product directory (directory traversal) and that the attack can only be performed by a privileged user who already has the ability to manage the configuration.

Critical Impact

Remote attackers with configuration management privileges can exploit the action_createconfig function to perform directory traversal and create files outside intended directories, potentially leading to further system compromise.

Affected Products

• Sangoma Asterisk v22
• Sangoma Asterisk (all versions potentially affected based on CPE data)

Discovery Timeline

• 2025-02-05 - CVE-2024-57520 published to NVD
• 2025-11-06 - Last updated in NVD database

Technical Details for CVE-2024-57520

Vulnerability Analysis

This vulnerability is classified under CWE-732 (Incorrect Permission Assignment for Critical Resource). The flaw resides in the action_createconfig function within Asterisk's Asterisk Manager Interface (AMI). This function, designed to allow authorized administrators to create configuration files, lacks proper validation of file paths provided by users.

The core issue stems from insufficient input sanitization that allows directory traversal sequences to be processed. When exploited, an authenticated attacker with configuration management privileges can specify paths containing traversal sequences (such as ../) to write files outside the intended Asterisk configuration directory. While the vendor disputes the severity, noting that only empty files can be created and the attack requires privileged access, the ability to write files to arbitrary locations on the filesystem could potentially be chained with other vulnerabilities for more severe impact.

Root Cause

The root cause of CVE-2024-57520 is improper permission assignment and insufficient path validation in the action_createconfig function. The function does not adequately sanitize or validate user-supplied file paths before processing file creation operations. This allows directory traversal sequences to bypass intended directory restrictions, enabling file creation outside the Asterisk product directory.

Attack Vector

The attack vector for CVE-2024-57520 is network-based. An attacker must first authenticate to the Asterisk Manager Interface (AMI) with credentials that have configuration management privileges. Once authenticated, the attacker can send specially crafted requests to the action_createconfig function containing directory traversal sequences in the filename parameter.

The exploitation flow involves:

1. Authenticating to AMI with appropriate privileges
2. Sending a CreateConfig action with a malicious filename containing traversal sequences
3. The function processes the path without proper validation
4. An empty file is created at the attacker-specified location outside the intended directory

Technical details and proof-of-concept information can be found at the GitHub Gist Code Snippet and the GitHub Asterisk Issue #1122.

Detection Methods for CVE-2024-57520

Indicators of Compromise

• Unexpected empty files appearing in directories outside the Asterisk configuration path
• AMI logs showing CreateConfig actions with unusual filename patterns containing ../ sequences
• Filesystem audit logs indicating file creation in sensitive directories by the Asterisk process
• Abnormal authentication patterns to the Asterisk Manager Interface

Detection Strategies

• Monitor AMI command logs for action_createconfig calls with filenames containing directory traversal patterns such as ../, ..\\, or absolute paths
• Implement file integrity monitoring (FIM) on critical system directories to detect unexpected file creation
• Configure network monitoring to alert on unusual AMI traffic patterns from untrusted sources
• Review Asterisk access logs for authentication attempts and configuration management actions

Monitoring Recommendations

• Enable comprehensive AMI logging and forward logs to a SIEM platform for analysis
• Implement real-time alerting for any CreateConfig actions with paths outside expected directories
• Monitor the Asterisk process for file operations outside its normal working directories using endpoint detection tools
• Establish baseline behavior for AMI administrative actions to detect anomalies

How to Mitigate CVE-2024-57520

Immediate Actions Required

• Review and restrict AMI user permissions to only those users who absolutely require configuration management capabilities
• Implement network-level access controls to limit AMI access to trusted IP addresses only
• Audit existing AMI user accounts and remove or disable any unnecessary privileged accounts
• Enable TLS encryption for AMI connections to prevent credential interception

Patch Information

As of the last update, no official patch has been released by Sangoma addressing this specific vulnerability. The vendor has disputed the severity of this CVE, noting that exploitation requires privileged access and only results in empty file creation. Organizations should monitor the GitHub Asterisk Issue #1122 for updates on the vendor's response and any forthcoming patches.

Workarounds

• Restrict AMI access using permit and deny directives in manager.conf to allow connections only from trusted management hosts
• Disable the CreateConfig action for users who do not require it by adjusting AMI user permissions
• Implement a reverse proxy or firewall rules to filter AMI requests containing suspicious path patterns
• Consider running Asterisk in a containerized environment to limit the impact of filesystem access

# Example manager.conf hardening configuration
[admin]
secret = strongpassword
deny = 0.0.0.0/0.0.0.0
permit = 192.168.1.100/255.255.255.255
read = system,call,log
write = system,call
writetimeout = 5000