SecBoard
Zurück zur CVE-Übersicht

CVE-2026-57193

NONE
Risk Signal Score1/100 — NIEDRIG

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

2.0%

Exploit-Wahrscheinlichkeit (30 Tage)

Beschreibung

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver `res_config_ldap` may permit `LDAP filter injection` through a `SIP username`, allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The `res_config_ldap` module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • Asterisk 20.20.1
  • Asterisk 21.12.3
  • Asterisk 22.10.1
  • Asterisk 23.4.1
  • Certified Asterisk 20.7-cert11
  • Certified Asterisk 22.8-cert3

Threat-Hunting-Queries

Detection focuses on SIP packets with unusual characters in the 'From' header, indicative of LDAP filter injection attempts. Requires logging of SIP traffic and potentially LDAP query logs if available.

Sentinel/Defender KQL

let suspicious_chars = dynamic(['*', '(', ')', '\\', '\x00']);
SIPEvents
| where isnotempty(FromHeader)
| where FromHeader has_any (suspicious_chars)
| project TimeGenerated, SourceIp, DestinationIp, FromHeader, UserAgent, EventType

Splunk SPL

sourcetype=sip_logs FromHeader=* OR FromHeader="(" OR FromHeader=")" OR FromHeader="\\" OR FromHeader="\x00"
| table _time, src_ip, dest_ip, FromHeader, UserAgent

Sigma

title: Asterisk LDAP Filter Injection Attempt
author: SecBoard
date: 2024/07/30
logsource:
  product: asterisk
  service: sip
detection:
  selection:
    FromHeader|contains:
      - '*'
      - '(' 
      - ')'
      - '\\'
      - '\x00'
  condition: selection
level: high

Elastic ES|QL

FROM sip_logs
| WHERE FromHeader : '*' OR FromHeader : '(' OR FromHeader : ')' OR FromHeader : '\\' OR FromHeader : '\x00'
| SELECT @timestamp, source.ip, destination.ip, FromHeader, user_agent

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen