SecBoard
Zurück zur CVE-Übersicht

CVE-2026-57200

HIGH(7.5)

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Risk Signal Score19/100 — NIEDRIG
  • CVSS 7.5 — Hoch

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.9%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

7.5

Technische Schwere

Beschreibung

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, under certain conditions, execute write operations through `REST-over-WebSocket`. The authorization bypass permits `arbitrary module path` loading and conditional remote code execution. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • Asterisk 20.20.1
  • Asterisk 21.12.3
  • Asterisk 22.10.1
  • Asterisk 23.4.1
  • Certified Asterisk 22.8-cert3

Threat-Hunting-Queries

Detects attempts to execute non-GET methods over REST-over-WebSocket by authenticated read-only ARI users. This requires logging of WebSocket requests and their methods/parameters.

Sentinel/Defender KQL

let WebSocketEvents = YourWebSocketLogs
| where Url contains "/ari/" and HttpMethod != "GET"
| where AuthenticatedUserHasReadOnlyPermissions == true; // Placeholder: Replace with actual logic to identify read-only users
WebSocketEvents

Splunk SPL

sourcetype=your_websocket_logs uri="/ari/" method!=GET authenticated_user_readonly=true

Sigma

title: Asterisk ARI WebSocket Authorization Bypass
status: experimental
description: Detects attempts to execute non-GET methods over REST-over-WebSocket by authenticated read-only ARI users.
logsource:
  product: asterisk
  service: ari_websocket
detection:
  selection:
    uri|contains: '/ari/'
    method|!nocase: 'GET'
    # Placeholder: Add condition for read-only user authentication if available in logs
  condition: selection

Elastic ES|QL

FROM your_websocket_logs
WHERE url LIKE '%/ari%' AND http.request.method != 'GET'
// AND authenticated_user.roles CONTAINS 'read-only' // Placeholder: Adjust based on actual log fields for user roles

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen