By Davy Douhine | December 6, 2017
Last summer during a pentest for a client we came across a product made by an international provider of intercom systems which uses the very popular Asterisk communication software and found a trivial remote command execution vulnerability in its latest GUI (2.1.0).
This product is used in many very sensitive environments like prisons and official buildings.
We’ve choose to “responsible disclose” them, directly to Digium and the ICS-CERT (Industrial Control Systems Cyber Emergency Response Team). Unfortunately it won’t be patched as the product is no longer maintained by Digium (https://wiki.asterisk.org/wiki/display/AST/Asterisk+GUI).
ICS-CERT has released an advisory and a CVE (CVE-2017-14001) has been assigned.
Many thanks to Digium and the ICS-CERT teams.
”(…) Successful exploitation of this vulnerability could cause an authenticated attacker to execute arbitrary code on the device. (…)“.
Asterisk GUI is no longer maintained and should not be used. Digium recommends affected users to migrate to Digium’s SwitchVox product.
As the GUI is open source code it could be patched by the resellers if they can’t migrate easily.
If not it is advised to avoid using default/weak credentials on Asterisk GUI and don’t expose it on Internet and unsafe networks.
In the wild
Searchs in Google or Shodan for “Server: Asterisk” on tcp ports 80,443,8080,8088,8089 give a few hundreds results.
2017/09/05 First mail sent to firstname.lastname@example.org
2017/09/06 Answer received: “I’ve looked over the code in question and it is still applicable (…)As the project isn’t maintained anymore we won’t be fixing and releasing an updated version ourselves.”
2017/09/06 Mail sent to email@example.com to ask a link to the affected code
2017/09/06 Answer received with links
2017/09/06 Full report (this document) sent to ICS-CERT
2017/09/21 ICS-CERT advisory is released