Summary
Asterisk contains an authorization bypass in REST-over-WebSocket that may allow an authenticated ARI user with read-only permissions to perform write operations under certain conditions.
If the HTTP server is enabled and reachable, this could permit arbitrary module path loading and potentially conditional remote code execution.
Asterisk contains an authorization bypass in REST-over-WebSocket that may allow an authenticated ARI user with read-only permissions to perform write operations under certain conditions.
If the HTTP server is enabled and reachable, this could permit arbitrary module path loading and potentially conditional remote code execution.
Affected context
The issue occurs in Asterisk deployments that expose the Asterisk REST Interface and support REST-over-WebSocket. Exploitation depends on the HTTP web server being enabled and reachable, valid read-only ARI credentials being available, and the affected authorization path accepting operations beyond the user's assigned permissions. Default settings may reduce exposure because the HTTP server is disabled and typically binds to localhost.
The issue occurs in Asterisk deployments that expose the Asterisk REST Interface and support REST-over-WebSocket. Exploitation depends on the HTTP web server being enabled and reachable, valid read-only ARI credentials being available, and the affected authorization path accepting operations beyond the user's assigned permissions. Default settings may reduce exposure because the HTTP server is disabled and typically binds to localhost.
Exploit preconditions
- Attack surface: Asterisk HTTP server and REST-over-WebSocket interface
- Required access: Valid credentials for an ARI account with read-only permissions
- Deployment condition: The Asterisk HTTP server must be enabled and reachable by the attacker
- Trigger point: Processing authorized REST-over-WebSocket requests
- Why exploitation is possible: Authorization checks may fail to consistently enforce read-only permissions across the WebSocket-backed operation path, allowing restricted users to reach write-capable functionality
- Attack surface: Asterisk HTTP server and REST-over-WebSocket interface
- Required access: Valid credentials for an ARI account with read-only permissions
- Deployment condition: The Asterisk HTTP server must be enabled and reachable by the attacker
- Trigger point: Processing authorized REST-over-WebSocket requests
- Why exploitation is possible: Authorization checks may fail to consistently enforce read-only permissions across the WebSocket-backed operation path, allowing restricted users to reach write-capable functionality
Why this happens
The underlying flaw is an inconsistent authorization boundary between ARI permissions and REST-over-WebSocket operations. A request authenticated with read-only privileges can reach functionality intended for users with write permissions when the WebSocket request path does not apply equivalent authorization checks.
This maps primarily to CWE-863: Incorrect Authorization, where a system fails to enforce the intended permission policy. The arbitrary module path behavior may also involve CWE-22: Improper Limitation of a Pathname to a Restricted Directory, if attacker-controlled paths are not sufficiently constrained.
The underlying flaw is an inconsistent authorization boundary between ARI permissions and REST-over-WebSocket operations. A request authenticated with read-only privileges can reach functionality intended for users with write permissions when the WebSocket request path does not apply equivalent authorization checks.
This maps primarily to CWE-863: Incorrect Authorization, where a system fails to enforce the intended permission policy. The arbitrary module path behavior may also involve CWE-22: Improper Limitation of a Pathname to a Restricted Directory, if attacker-controlled paths are not sufficiently constrained.
Potential impact
- Unauthorized modification of Asterisk or telephony state
- Loading of attacker-selected modules or module paths
- Conditional execution of attacker-controlled code in the Asterisk process
- Compromise of call-handling services and connected integrations
- Exposure or disruption of communications and operational data
- Unauthorized modification of Asterisk or telephony state
- Loading of attacker-selected modules or module paths
- Conditional execution of attacker-controlled code in the Asterisk process
- Compromise of call-handling services and connected integrations
- Exposure or disruption of communications and operational data
General mitigation guidance
Mitigation generally focuses on enforcing authorization consistently across HTTP, WebSocket, and ARI operation paths.
Common defensive patterns include:
- Apply explicit permission checks to every operation, including WebSocket-wrapped requests
- Separate read and write capabilities using deny-by-default authorization policies
- Restrict module loading to trusted, fixed directories and approved module names
- Keep the Asterisk HTTP server disabled when it is not required
- Bind management interfaces to trusted administrative networks rather than broad interfaces
- Protect ARI credentials with least privilege, strong authentication, and controlled distribution
- Run Asterisk with minimal operating-system privileges and isolate management services
- Treat authorization failures and module-loading attempts as security events
Mitigation generally focuses on enforcing authorization consistently across HTTP, WebSocket, and ARI operation paths.
Common defensive patterns include:
- Apply explicit permission checks to every operation, including WebSocket-wrapped requests
- Separate read and write capabilities using deny-by-default authorization policies
- Restrict module loading to trusted, fixed directories and approved module names
- Keep the Asterisk HTTP server disabled when it is not required
- Bind management interfaces to trusted administrative networks rather than broad interfaces
- Protect ARI credentials with least privilege, strong authentication, and controlled distribution
- Run Asterisk with minimal operating-system privileges and isolate management services
- Treat authorization failures and module-loading attempts as security events
How teams detect issues like this
Detection can include static analysis for authorization checks that differ between HTTP and WebSocket handlers, especially where read-only roles are translated into operation permissions. Code review should examine every route, event, and delegated request path for consistent policy enforcement and should flag attacker-influenced module or filesystem paths.
Runtime monitoring can alert on read-only ARI accounts issuing write-capable operations, unexpected WebSocket activity, module-loading requests, and access to management interfaces from untrusted networks. Policy enforcement can restrict HTTP exposure, ARI role assignment, and permitted module directories. Automated code review and security scanning tools may help identify inconsistent authorization and path-validation patterns.
Detection can include static analysis for authorization checks that differ between HTTP and WebSocket handlers, especially where read-only roles are translated into operation permissions. Code review should examine every route, event, and delegated request path for consistent policy enforcement and should flag attacker-influenced module or filesystem paths.
Runtime monitoring can alert on read-only ARI accounts issuing write-capable operations, unexpected WebSocket activity, module-loading requests, and access to management interfaces from untrusted networks. Policy enforcement can restrict HTTP exposure, ARI role assignment, and permitted module directories. Automated code review and security scanning tools may help identify inconsistent authorization and path-validation patterns.
