Executive Summary

This vulnerability exists in AudioCodes Fax Server and Auto-Attendant IVR appliances up to version 2.6.23. It involves a web administration component called F2MAdmin that has an unauthenticated file upload endpoint. This endpoint allows anyone to upload files without authentication, authorization, or file-type validation, writing them to a specific directory. An attacker can upload or overwrite audio prompt or music-on-hold files, potentially tampering with IVR audio content or using these files to facilitate further attacks.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can allow a remote, unauthenticated attacker to upload or overwrite audio files used by the IVR system. This could lead to tampering with the audio content that callers hear, potentially causing misinformation or disruption. Additionally, the attacker might use the uploaded files as a foothold for further attacks against the system or network.

Useful 0 Not Useful 0

Detection Guidance

Detection can be performed by checking for the presence of the vulnerable script at the path AudioCodes_files/utils/IVR/diagram/ajaxPromptUploadFile.php on the AudioCodes Fax Server or Auto-Attendant IVR appliances. Network monitoring for HTTP POST requests to this endpoint without authentication may indicate exploitation attempts. Additionally, inspecting the C:\F2MAdmin\tmp directory for unexpected or recently modified files related to prompts or music-on-hold can help identify exploitation. Specific commands depend on the environment, but for example, on the server, listing files by modification date in the tmp directory can be done with: dir C:\F2MAdmin\tmp /T:W. Network traffic capture tools like Wireshark or tcpdump can be used to monitor HTTP POST requests to the vulnerable URL.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable web administration component, especially the ajaxPromptUploadFile.php endpoint, by implementing network-level controls such as firewall rules or access control lists to limit access to trusted administrators only. If possible, disable or remove the vulnerable script or upgrade the AudioCodes Fax Server and Auto-Attendant IVR appliances to a version later than 2.6.23 where this vulnerability is fixed. Monitoring and auditing the C:\F2MAdmin\tmp directory for unauthorized file uploads and removing any suspicious files is also recommended.

Useful 0 Not Useful 0