CVE-2024-42365
Certified Asterisk 13.13.0 … 20.7
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:LSummary
CVE-2024-42365 is a high-severity Privilege Defined With Unsafe Actions (CWE-267) vulnerability in Asterisk Certified Asterisk. Its CVSS base score is 7.4 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Access Token Manipulation (T1134); ranked in the top 9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
Asterisk, an open source PBX and telephony toolkit, contains an improper access control flaw in its Asterisk Manager Interface (AMI) that affects all versions prior to 18.24.2, 20.9.2, 21.4.2 and the corresponding certified-asterisk releases 18.9-cert11 and 20.7-cert2. An authenticated AMI user granted the originate write permission can leverage the CURL() dialplan function together with the SET application’s FILE() function to retrieve remote content and overwrite or append to any file under /etc/asterisk/, bypassing intended configuration restrictions.
An attacker with a low-privileged AMI account can therefore escalate privileges, inject arbitrary dialplan or module configuration, achieve remote code execution, or perform blind server-side request forgery against arbitrary protocols by writing chosen payloads into Asterisk configuration files that are subsequently loaded by the server.
The referenced commits and updated releases (18.24.2, 20.9.2, 21.4.2, 18.9-cert11, 20.7-cert2) contain the corrective changes that restrict the ability of originate-authorized AMI users to write arbitrary files via these functions. The EPSS score for this CVE rose from a low baseline to a peak of 0.4971, indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-39574
Vulnerability Data
Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with `write=originate` may change all configuration files in the `/etc/asterisk/` directory.…
more
This occurs because they are able to curl remote files and write them to disk, but are also able to append to existing files using the `FILE` function inside the `SET` application. This issue may result in privilege escalation, remote code execution and/or blind server-side request forgery with arbitrary protocol. Asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2 contain a fix for this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 14 hardening rules · 8 OS baselines
V16.4.2V13.2.2V8.4.2V11.7.1
Mitigating Controls (NIST 800-53 r5) AI
Least privilege explicitly demands that only the minimum necessary accesses are granted, eliminating the broad permissions that define this weakness.
AC-24 requires access decisions to be applied precisely and unambiguously to every request, structurally blocking insufficiently granular policies.
AC-3 requires enforcement of authorizations according to policy, directly compelling sufficiently granular rules so broad allowances cannot be introduced.
AC-4 enforces approved information flows with explicit source/destination rules, preventing overly coarse access policies from being deployed.
Separation of duties splits high-risk actions across multiple privileges so that no single privilege can perform the full unsafe sequence.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Defining and enforcing least-privilege permissions directly reduces the chance that a privilege permits unintended unsafe actions.
PR.IR-01's segmentation + zero-trust rules directly enforce minimum-necessary access at network boundaries, removing most instances of overly broad policy; CWE-1220 can still exist in application-layer or intra-segment controls that this single outcome does not address.
PR.PS-06's general SDLC practices can surface granularity issues during design/review (partial prevention) but do not specifically target access-control policy breadth, so they remove only part of CWE-1220's risk.
CWE-1220 permits unauthorized access to sensitive assets but neither prevents nor impairs the delivery of adverse-event information to authorized recipients.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use of privileged utility programs restricts dangerous tools but does not address unsafe actions within assigned privileges.
Directly requires information-access restriction at the level of individual assets and operations, addressing the granularity gap.
Access control policy can limit unsafe privilege use but does not define safe actions for each privilege.
Access rights assignment can restrict privileges to intended actions, yet does not guarantee the privilege itself is safe.
Segregation of duties reduces risk of unsafe actions by splitting privileges but does not address unsafe privilege definitions.
Privileged access rights control can restrict unsafe privileges, yet does not ensure the privilege definition itself is safe.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 9 (1 rule)
- V-271725 OL 9 must require users to provide a password for privilege escalation. prevents CWE-267
Ubuntu 22.04 (3 rules)
- V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-267
- V-260529 Ubuntu 22.04 LTS must be configured so that remote X connections are disabled, unless to fulfill documented and validated mission requirements. prevents CWE-267
- V-260542 Ubuntu 22.04 LTS must prevent direct login into the root account. prevents CWE-267
Windows Server 2016 (1 rule)
- V-225025 Local accounts with blank passwords must be restricted to prevent access from the network. prevents CWE-1220
Windows Server 2022 (1 rule)
- V-254446 Windows Server 2022 must prevent local accounts with blank passwords from being used from the network. prevents CWE-1220