Path Traversal Vulnerability in Asterisk Package
Summary
ALPINE-CVE-2024-53566: An issue in the action_listcategories() function of Sangoma Asterisk v22/22.0.0/22.0.0-rc1/22.0.0-rc2/22.0.0-pre1 allows attackers to execute a path traversal. Affects asterisk versions < 18.24.3-r1. Fixed in 18.24.3-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Asterisk is an open-source framework for building communications applications. It is widely used for VoIP (Voice over Internet Protocol) services, enabling users to create custom telephony solutions. The package is known for its flexibility and extensive features, including call routing, voicemail, and conference calling. However, it has been identified to have a vulnerability that could allow unauthorized access to the file system.
Vulnerability Detail
An issue exists in the action_listcategories() function of Sangoma Asterisk versions 22, including 22.0.0, 22.0.0-rc1, 22.0.0-rc2, and 22.0.0-pre1. This vulnerability allows attackers to execute a path traversal attack, potentially leading to unauthorized access to sensitive files on the server. The vulnerability stems from improper validation of user input, which can be exploited to manipulate file paths.
How To Fix
Minimum fixed version
18.24.3-r1
This is the first release that contains the fix.
sudo apk add --upgrade asteriskTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the Asterisk service and implement strict input validation on user inputs to mitigate the risk of path traversal attacks until the package can be updated.
Conclusion
The identified path traversal vulnerability in the Asterisk package poses significant security risks, allowing unauthorized access to the file system. It is crucial for users to update to the patched versions as soon as possible and implement recommended workarounds to protect their systems.
See every vulnerability recorded for asterisk →
FAQ
The vulnerability is a path traversal issue that allows attackers to access files outside the intended directory structure.
Affected versions include Asterisk v22, specifically 22.0.0, 22.0.0-rc1, 22.0.0-rc2, and 22.0.0-pre1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Exploitation of this vulnerability could lead to unauthorized access to sensitive files, potentially compromising the security of the system.
Yes, restricting access to the Asterisk service and implementing strict input validation can help mitigate the risk until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for asterisk.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
