CVE-2025-47779: Sangoma Asterisk Auth Bypass Vulnerability

CVE-2025-47779 Overview

CVE-2025-47779 affects Asterisk, an open-source private branch exchange (PBX) widely deployed for VoIP telephony. The vulnerability stems from improper alignment of authentication on Session Initiation Protocol (SIP) MESSAGE requests defined in RFC 3428. An authenticated attacker can spoof any user identity and deliver chat messages that appear to originate from trusted entities. Even administrators following documented security best practices remain exposed. The flaw enables spam, phishing, and social engineering campaigns delivered over trusted PBX infrastructure. Sangoma addressed the issue in Asterisk versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1, along with certified-asterisk 18.9-cert14 and 20.7-cert5.

Critical Impact

Authenticated attackers can impersonate any SIP user to send spoofed chat messages, enabling phishing and social engineering attacks against trusted PBX users.

Affected Products

• Sangoma Asterisk versions prior to 18.26.2, 20.14.1, 21.9.1, and 22.4.1
• Sangoma certified-asterisk 18.9 prior to cert14
• Sangoma certified-asterisk 20.7 prior to cert5

Discovery Timeline

• 2025-05-22 - CVE-2025-47779 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47779

Vulnerability Analysis

The vulnerability resides in the way Asterisk processes SIP MESSAGE requests used for out-of-dialog instant messaging under RFC 3428. Asterisk authenticates the incoming request but fails to align the authenticated identity with the From header presented in the message body. As a result, an attacker holding valid credentials for one SIP account can inject arbitrary identities into outbound MESSAGE traffic. The receiving endpoint renders the spoofed sender, presenting the message as if it came from a trusted internal user such as an administrator, executive, or help-desk operator. The issue is classified as [CWE-140] Improper Neutralization of Delimiters, reflecting the parsing and alignment failure between authentication context and message headers.

Root Cause

The root cause is missing enforcement between the authenticated SIP endpoint and the identity claimed in the MESSAGE request. Asterisk validates the credentials of the sender but does not require the From URI to match the authenticated principal. This allows the credentialed sender to arbitrarily rewrite their apparent identity for messages routed to other users on the PBX.

Attack Vector

Exploitation requires network reachability to the SIP service and a single set of valid PBX credentials. The attacker crafts a SIP MESSAGE request in which the authentication header carries their real account, while the From header advertises a spoofed user identity. Asterisk forwards the message to the destination, which displays the spoofed sender. Any user with a working SIP extension on the PBX can perform the attack against any other user on the same system.

No verified public proof-of-concept code is available. See the GitHub Security Advisory GHSA-2grh-7mhv-fcfw for the vendor's technical write-up.

Detection Methods for CVE-2025-47779

Indicators of Compromise

• SIP MESSAGE requests where the authenticated username in the Authorization header does not match the user portion of the From URI.
• Unusual volume of chat messages originating from a single authenticated extension but claiming multiple identities.
• User reports of chat messages appearing to come from administrators, executives, or system accounts that did not send them.

Detection Strategies

• Enable and review SIP debug logging on the PBX to correlate authenticated identities with the From headers of MESSAGE requests.
• Deploy network monitoring on SIP signaling ports (typically 5060/UDP and 5061/TCP) to inspect MESSAGE traffic for identity mismatches.
• Correlate PBX authentication events with outbound messaging activity to identify accounts sending on behalf of other users.

Monitoring Recommendations

• Forward Asterisk CDR, security, and SIP debug logs to a centralized log platform for retention and analysis.
• Build alerts for anomalous MESSAGE request rates per authenticated account, particularly outside business hours.
• Track user-reported phishing or impersonation attempts and pivot on the associated SIP session identifiers.

How to Mitigate CVE-2025-47779

Immediate Actions Required

• Upgrade Asterisk to version 18.26.2, 20.14.1, 21.9.1, or 22.4.1, or upgrade certified-asterisk to 18.9-cert14 or 20.7-cert5.
• Audit existing SIP accounts and rotate credentials for any account showing suspicious MESSAGE activity.
• Notify PBX users of the spoofing risk and instruct them to verify sensitive chat messages through a secondary channel until patches are applied.

Patch Information

Sangoma released fixes in Asterisk 18.26.2, 20.14.1, 21.9.1, and 22.4.1, and in certified-asterisk 18.9-cert14 and 20.7-cert5. Debian users should apply updates announced in the Debian LTS Announcement. Full remediation details are published in the GitHub Security Advisory GHSA-2grh-7mhv-fcfw.

Workarounds

• If patching is not immediately possible, disable SIP MESSAGE handling by removing or restricting the message endpoint context in pjsip.conf.
• Restrict SIP signaling to trusted network segments using firewall rules and VPN-only access to reduce the pool of potential authenticated attackers.
• Enforce strong, unique passwords on every SIP endpoint to limit credential compromise that would enable this attack.

# Reference the sample PJSIP configuration to constrain MESSAGE handling:
# https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample
#
# Example: verify installed version after upgrade
asterisk -rx "core show version"