CVE-2024-57520

The vulnerability classified as CWE-732 (improper resource permissions) results from lack of proper path validation in the action_createconfig function. An attacker can use this function to create empty files in locations outside the Asterisk directory, which is a classic path traversal. However, the vendor notes that this operation requires a logged-in user with configuration management permissions and is not available to anonymous attackers.

An attacker with appropriate permissions can create empty files in arbitrary locations on the server's file system. The vendor disputes the possibility of full RCE, indicating that the impact is limited to writing empty files outside the product directory.

Apply patches available from the vendor according to the references. Since the attack requires privileged access, additionally apply the principle of least privilege and restrict access to the Asterisk management interface exclusively to trusted users and networks.

Sangoma Asterisk v22