Executive Summary

This vulnerability is a local privilege escalation issue in the safe_asterisk script used to start the Asterisk telephony software in non-systemd environments. The script runs as root and executes all shell scripts (*.sh) in the /etc/asterisk/startup.d directory without checking their ownership or permissions. If a non-root user has write access to /etc/asterisk, they can place malicious scripts in this directory. When Asterisk is restarted via safe_asterisk, these scripts run with root privileges, allowing the user to escalate their privileges to root. [1]

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability allows a non-root user with write access to /etc/asterisk to execute arbitrary code with root privileges. This means an attacker can gain full control over the affected system, potentially leading to unauthorized access, data manipulation, or disruption of services. [1]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if the /etc/asterisk/startup.d directory exists and contains any .sh scripts that could be executed by safe_asterisk. Also, verify if non-root users have write access to /etc/asterisk, which would allow them to place malicious scripts. For example, run the following commands: 1. Check if the startup.d directory exists and list scripts: ls -l /etc/asterisk/startup.d/*.sh 2. Check permissions on /etc/asterisk: ls -ld /etc/asterisk 3. Check which users have write access to /etc/asterisk: getfacl /etc/asterisk 4. To test if the vulnerability is present, create a test script (e.g., 01-test.sh) in /etc/asterisk/startup.d that performs a privileged action (like creating a root-owned file), then restart Asterisk using safe_asterisk and check if the action was executed with root privileges. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include: 1. Restrict write permissions to the /etc/asterisk directory so that only trusted users (preferably root) can write to it, preventing unprivileged users from placing scripts in startup.d. 2. Remove or rename the /etc/asterisk/startup.d directory if it is not needed. 3. Upgrade Asterisk to a fixed version where this vulnerability is patched (e.g., 18.26.3, 20.15.1, 21.10.1, 22.5.1, 18.9-cert16, or 20.7-cert7). 4. Use the recommended systemd asterisk.service file to start Asterisk instead of safe_asterisk, as this method is not vulnerable. 5. Audit existing scripts in /etc/asterisk/startup.d for any unauthorized or suspicious files. [1]

Useful 0 Not Useful 0