CVE-2026-23741: Asterisk Privilege Escalation Vulnerability

CVE-2026-23741 Overview

Asterisk, an open source private branch exchange (PBX) and telephony toolkit, contains a local privilege escalation vulnerability in its ast_coredumper diagnostic script. The vulnerability exists because the script runs as root and sources configuration from /etc/asterisk/ast_debug_tools.conf, a file located in a directory writable by the asterisk user. An attacker with asterisk user privileges can inject arbitrary bash code into this configuration file, which will then be executed with root privileges when the ast_coredumper script is run.

Critical Impact

Attackers with write access to the Asterisk configuration directory can achieve root-level code execution by injecting malicious bash commands into the ast_debug_tools.conf file, potentially leading to complete system compromise.

Affected Products

• Asterisk versions prior to 20.7-cert9
• Asterisk versions prior to 20.18.2
• Asterisk versions prior to 21.12.1
• Asterisk versions prior to 22.8.2
• Asterisk versions prior to 23.2.2

Discovery Timeline

• 2026-02-06 - CVE CVE-2026-23741 published to NVD
• 2026-02-06 - Last updated in NVD database

Technical Details for CVE-2026-23741

Vulnerability Analysis

This vulnerability is classified as CWE-427 (Uncontrolled Search Path Element). The ast_coredumper script, located at asterisk/contrib/scripts/ast_coredumper, is a diagnostic utility designed to process core dumps from Asterisk. The script is intended to be run with root privileges, as noted in the NOTES tag on line 689 of the script file.

The core issue lies in the script's behavior of sourcing the contents of /etc/asterisk/ast_debug_tools.conf. Since bash's source command executes all commands found in the sourced file, any arbitrary code placed in this configuration file will be executed with the same privileges as the running script—in this case, root.

The /etc/asterisk/ directory is typically owned by and writable by the asterisk user and group. This creates a privilege escalation path where a lower-privileged user (asterisk) can influence the behavior of a root-level process.

Root Cause

The root cause is an insecure trust boundary between the asterisk user's writable configuration directory and a script that runs with elevated (root) privileges. The ast_coredumper script fails to validate or sanitize the contents of /etc/asterisk/ast_debug_tools.conf before sourcing it. Since bash configuration files can contain arbitrary commands and the file follows bash semantics, any attacker who can write to this file gains the ability to execute arbitrary commands as root.

Attack Vector

The attack requires local access to the system with the ability to write to the /etc/asterisk/ directory, typically achieved through compromising the asterisk user account. The attack vector is local, requires no authentication beyond having asterisk user privileges, but does require user interaction—specifically, an administrator must run the ast_coredumper script for the malicious code to execute.

An attacker would craft malicious bash code and write it to /etc/asterisk/ast_debug_tools.conf. When an administrator subsequently runs the ast_coredumper script (typically during troubleshooting of a crash), the malicious payload executes with root privileges. This could include actions such as creating backdoor accounts, installing rootkits, exfiltrating sensitive data, or further compromising the system.

Detection Methods for CVE-2026-23741

Indicators of Compromise

• Unexpected modifications to /etc/asterisk/ast_debug_tools.conf file, especially unusual bash commands or shell syntax
• Suspicious processes spawned as children of the ast_coredumper script
• Unauthorized changes to system files or user accounts following ast_coredumper execution
• Audit log entries showing writes to ast_debug_tools.conf by the asterisk user

Detection Strategies

• Implement file integrity monitoring (FIM) on /etc/asterisk/ast_debug_tools.conf to detect unauthorized modifications
• Monitor execution of ast_coredumper and correlate with any unusual system activity or process spawning
• Review audit logs for write operations to the Asterisk configuration directory by the asterisk user
• Deploy endpoint detection and response (EDR) solutions to identify privilege escalation attempts

Monitoring Recommendations

• Enable auditd rules to track modifications to /etc/asterisk/ast_debug_tools.conf
• Configure alerting for any shell commands executed as root that originate from the ast_coredumper process
• Implement baseline monitoring for the Asterisk configuration directory to detect anomalous file changes
• Use SentinelOne's behavioral AI to detect suspicious process chains involving diagnostic scripts escalating to root

How to Mitigate CVE-2026-23741

Immediate Actions Required

• Upgrade Asterisk to patched versions: 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, or 23.2.2
• Review the contents of /etc/asterisk/ast_debug_tools.conf for any suspicious or unauthorized entries
• Restrict write permissions on /etc/asterisk/ast_debug_tools.conf to root only until patching is complete
• Audit recent executions of ast_coredumper and review system logs for signs of compromise

Patch Information

Asterisk has released patched versions that address this vulnerability. Organizations should upgrade to one of the following versions based on their deployment:

• Version 20.7-cert9 (certified branch)
• Version 20.18.2
• Version 21.12.1
• Version 22.8.2
• Version 23.2.2

For detailed patch information and security advisory, refer to the GitHub Security Advisory.

Workarounds

• Change ownership of /etc/asterisk/ast_debug_tools.conf to root and remove write permissions for the asterisk user
• Create an immutable flag on the configuration file using chattr +i /etc/asterisk/ast_debug_tools.conf
• Avoid running ast_coredumper until the system is patched
• Consider running Asterisk in a containerized environment with restricted filesystem access

# Configuration example
# Secure the configuration file permissions as a temporary workaround
chown root:root /etc/asterisk/ast_debug_tools.conf
chmod 644 /etc/asterisk/ast_debug_tools.conf
chattr +i /etc/asterisk/ast_debug_tools.conf

# Verify file permissions
ls -la /etc/asterisk/ast_debug_tools.conf
lsattr /etc/asterisk/ast_debug_tools.conf