CVE-2024-49215

What it actually does

The vulnerability permits path traversal in Asterisk Manager Interface functions action_getconfig() and action_getconfigJson() because input file paths are not sanitized, allowing access to arbitrary files on the filesystem even when restrictedFile() checks are present.

Why it matters to the business

Attackers could read sensitive configuration and system files, exposing operational details that aid further compromise and increasing the chance of service disruption or data leakage in telephony environments.

How an attack unfolds

An attacker with Manager Interface credentials supplies a crafted path containing traversal sequences such as ../../ to the getconfig or getconfigJson actions; the missing or bypassed path processing allows retrieval of files outside intended directories.

How to fix it

Upgrade Asterisk to the version containing commit 85601849c646709836f59007d04ca829ef0d5955 or later; for affected concrete5 installations upgrade to 8.5.19.

How to confirm the fix worked

Confirm the installed version matches a fixed release, then attempt a traversal path via the Manager Interface and verify that requests are rejected or sanitized.

Typical attack path

1. Obtain valid credentials for the Asterisk Manager Interface
2. Craft a request containing directory traversal sequences in the filename parameter
3. Invoke action_getconfig or action_getconfigJson
4. Receive contents of arbitrary files from the target filesystem

How to detect it

Inspect Asterisk manager logs for getconfig or getconfigJson actions that contain repeated dot-dot-slash sequences or references to sensitive paths such as /etc.

What your security team should do

• Apply the listed fixed versions immediately
• Restrict network access to the Manager Interface to trusted hosts only
• Review Manager Interface accounts and disable unused ones