CVE-2026-23739: Asterisk XXE Vulnerability

CVE-2026-23739 Overview

Asterisk, the widely-deployed open source private branch exchange (PBX) and telephony toolkit, contains an XML External Entity (XXE) vulnerability in its XML parsing implementation. The vulnerability exists in the ast_xml_open() function within xml.c, which parses XML documents using libxml with unsafe parsing options that enable entity expansion and XInclude processing.

Specifically, the function invokes xmlReadFile() with the XML_PARSE_NOENT flag and subsequently processes XIncludes via xmlXIncludeProcess(). When any untrusted or user-supplied XML file is passed to this function, attackers can trigger XXE or XInclude-based local file disclosure, potentially exposing sensitive files from the host system. This can also be triggered in other scenarios where users are able to supply input in XML format that causes the Asterisk process to parse it.

Critical Impact

Successful exploitation could allow attackers to read sensitive files from Asterisk PBX servers, potentially exposing VoIP configurations, credentials, and other confidential data.

Affected Products

• Asterisk versions prior to 20.7-cert9
• Asterisk versions prior to 20.18.2
• Asterisk versions prior to 21.12.1
• Asterisk versions prior to 22.8.2
• Asterisk versions prior to 23.2.2

Discovery Timeline

• 2026-02-06 - CVE CVE-2026-23739 published to NVD
• 2026-02-06 - Last updated in NVD database

Technical Details for CVE-2026-23739

Vulnerability Analysis

This vulnerability is classified as CWE-611 (Improper Restriction of XML External Entity Reference). The root issue lies in how the Asterisk application handles XML document parsing through the libxml2 library. The parsing configuration permits dangerous features that should be disabled when processing untrusted input.

The XML_PARSE_NOENT flag instructs the parser to substitute entity references, which enables attackers to define external entities pointing to local files or internal network resources. Combined with XInclude processing via xmlXIncludeProcess(), this creates a powerful attack surface for file disclosure.

The attack requires network access and typically requires elevated privileges along with user interaction, which somewhat limits the attack surface. However, in environments where Asterisk accepts XML configuration or data from less trusted sources, the risk of exploitation increases.

Root Cause

The vulnerability stems from insecure XML parsing configuration in the ast_xml_open() function. The function passes XML_PARSE_NOENT to xmlReadFile(), which enables entity substitution without proper restrictions on external entity resolution. Additionally, the subsequent call to xmlXIncludeProcess() expands XInclude elements, creating another vector for file inclusion attacks.

Secure XML parsing should disable DTD processing, external entity resolution, and XInclude processing when handling untrusted input. The Asterisk implementation failed to implement these security controls.

Attack Vector

The attack is network-based and targets the XML parsing functionality in Asterisk. An attacker who can supply malicious XML content to the Asterisk system can craft a payload containing external entity declarations or XInclude elements that reference sensitive local files.

When Asterisk parses this malicious XML, the libxml2 library resolves the external references and includes the file contents in the parsed document. The attacker can then exfiltrate this data through various techniques, such as out-of-band (OOB) data exfiltration via HTTP requests to attacker-controlled servers.

Typical XXE payloads would define external entities pointing to system files like /etc/passwd, configuration files, or Asterisk-specific files such as sip.conf or extensions.conf that may contain credentials and sensitive configuration data.

Detection Methods for CVE-2026-23739

Indicators of Compromise

• Unusual XML content in Asterisk logs containing <!DOCTYPE, <!ENTITY, or <xi:include declarations
• Unexpected file access attempts from the Asterisk process to sensitive system files
• Outbound HTTP/HTTPS connections from the Asterisk server to unknown external hosts
• Error messages related to XML parsing or entity resolution failures

Detection Strategies

• Monitor Asterisk process for file read operations outside expected directories
• Implement network monitoring to detect out-of-band data exfiltration attempts
• Review Asterisk logs for malformed or suspicious XML input patterns
• Deploy file integrity monitoring on critical configuration files

Monitoring Recommendations

• Enable verbose logging for XML parsing operations in Asterisk
• Configure network-level monitoring to alert on unusual outbound connections from PBX servers
• Implement application-level logging to capture all XML input received by Asterisk
• Use endpoint detection solutions to monitor for anomalous file access patterns

How to Mitigate CVE-2026-23739

Immediate Actions Required

• Upgrade Asterisk to patched versions: 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, or 23.2.2
• Review and restrict sources of XML input to the Asterisk system
• Implement network segmentation to limit Asterisk server's access to sensitive internal resources
• Audit existing configurations for any user-controllable XML input vectors

Patch Information

Asterisk has released patched versions that address this vulnerability by implementing secure XML parsing options. Affected organizations should upgrade to one of the following fixed versions:

• Version 20.7-cert9 (certified branch)
• Version 20.18.2
• Version 21.12.1
• Version 22.8.2
• Version 23.2.2

For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• Restrict XML input sources to trusted internal systems only
• Implement input validation to reject XML documents containing DOCTYPE declarations or external entity references
• Use network firewalls to block outbound connections from Asterisk servers to untrusted networks
• Consider deploying a Web Application Firewall (WAF) or XML gateway to filter malicious XML payloads before they reach Asterisk

# Configuration example - Network restriction for Asterisk
# Add to firewall rules to limit outbound connections from Asterisk server
iptables -A OUTPUT -m owner --uid-owner asterisk -p tcp --dport 80 -j DROP
iptables -A OUTPUT -m owner --uid-owner asterisk -p tcp --dport 443 -j DROP