CVE-2025-1131: Sangoma Asterisk Privilege Escalation Flaw

CVE-2025-1131 Overview

CVE-2025-1131 is a local privilege escalation vulnerability in the safe_asterisk script bundled with the Asterisk toolkit package from Sangoma. The script, commonly invoked by SysV init systems and FreePBX deployments, sources every .sh file located in /etc/asterisk/startup.d/ as root. It does not validate ownership or file permissions before execution. Non-root users with legitimate write access to /etc/asterisk can drop malicious scripts in the startup.d directory. Those scripts execute with root privileges the next time the Asterisk service restarts. The flaw is tracked under CWE-427: Uncontrolled Search Path Element.

Critical Impact
Any user with write access to /etc/asterisk/startup.d/ can achieve full root code execution on affected Asterisk hosts upon the next service restart.

Affected Products

Sangoma Asterisk (versions shipping the safe_asterisk script)
Sangoma Certified Asterisk 18.9 (cert1 through cert15)
Sangoma Certified Asterisk 20.7 (cert1 through cert6)

Discovery Timeline

2025-09-23 - CVE-2025-1131 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1131

Vulnerability Analysis

The safe_asterisk wrapper script starts the Asterisk daemon and executes environment initialization logic before handing control to the main process. As part of that initialization, it iterates over /etc/asterisk/startup.d/ and sources any file matching *.sh into the running root shell context. The script performs no checks on file owner, group, or mode bits. It also does not verify that the parent directory is exclusively writable by root.

Many packaged Asterisk deployments grant the asterisk user, or an administrative group such as FreePBX operators, write access to files under /etc/asterisk/. The trust boundary between the low-privilege asterisk runtime account and the root service manager collapses when the wrapper sources attacker-controlled shell code. The result is straightforward local privilege escalation from any account with write permissions into startup.d.

Root Cause

The root cause is missing input validation on a privileged code path. safe_asterisk treats the startup.d directory as a trusted source of executable code without enforcing that its contents are root-owned and not world-writable. This maps to CWE-427, where a privileged process loads a resource from a location that lower-privileged users can influence.

Attack Vector

Exploitation requires local access with write permissions to /etc/asterisk/startup.d/. An attacker creates a file such as /etc/asterisk/startup.d/backdoor.sh containing arbitrary shell commands. When an administrator restarts the Asterisk service, or when the host reboots, safe_asterisk sources the file as root. The attacker's commands then run with full root authority, allowing credential theft, persistence, or lateral movement. No user interaction beyond the service restart is required, and no network access is needed.

Detailed technical context is available in the Asterisk GitHub Security Advisory GHSA-v9q8-9j8m-5xwp.

Detection Methods for CVE-2025-1131

Indicators of Compromise

Unexpected .sh files present in /etc/asterisk/startup.d/ not owned by root or installed by the distribution package
Files under /etc/asterisk/startup.d/ with group or world-writable permissions
New root-owned processes, cron jobs, or SUID binaries appearing shortly after an Asterisk service restart

Detection Strategies

Audit ownership and mode bits on /etc/asterisk/ and /etc/asterisk/startup.d/ and alert when non-root users have write access
Monitor file creation and modification events in /etc/asterisk/startup.d/ using auditd or an equivalent file integrity monitoring tool
Correlate Asterisk service restarts with child process trees originating from safe_asterisk to identify unexpected shell activity

Monitoring Recommendations

Enable Linux audit rules on /etc/asterisk/startup.d/ to capture open and write syscalls from non-root UIDs
Ship shell execution telemetry from Asterisk hosts to a centralized log store for retrospective hunting
Baseline the expected contents of startup.d on each PBX host and alert on any deviation

How to Mitigate CVE-2025-1131

Immediate Actions Required

Restrict /etc/asterisk/ and /etc/asterisk/startup.d/ to root ownership with mode 0755 on directories and 0644 on files
Remove any unnecessary shell scripts from /etc/asterisk/startup.d/ and audit remaining files for integrity
Review group membership on the asterisk account and revoke write access from any non-administrative users

Patch Information

Apply the fixed Asterisk packages published by the upstream project. Refer to the Asterisk GitHub Security Advisory GHSA-v9q8-9j8m-5xwp for fixed release versions. Debian-based systems should apply the updates described in the Debian LTS Announcement.

Workarounds

Modify the local safe_asterisk script to validate that each file in startup.d is owned by root and not writable by other users before sourcing it
Empty the /etc/asterisk/startup.d/ directory and manage startup logic through a root-controlled configuration path
Run Asterisk under systemd with a hardened unit file that avoids invoking safe_asterisk entirely

bash

# Configuration example: enforce root ownership and safe permissions
sudo chown -R root:root /etc/asterisk/startup.d
sudo chmod 0755 /etc/asterisk/startup.d
sudo find /etc/asterisk/startup.d -type f -name '*.sh' -exec chmod 0644 {} \;

# Verify no non-root writable files remain
find /etc/asterisk/startup.d -type f \( ! -user root -o -perm /022 \)