CVE-2024-53566

What it actually does

Path traversal flaw in action_listcategories() permits an attacker to supply crafted input that escapes the intended directory and accesses files outside the expected scope.

Why it matters to the business

Attackers may read sensitive configuration files, call detail records, or other system data, leading to information disclosure that could aid further attacks or expose customer communications metadata.

How an attack unfolds

An unauthenticated or low-privileged remote attacker sends a specially crafted request to the Asterisk HTTP interface invoking action_listcategories with directory traversal sequences; the server fails to sanitize the path and returns contents of arbitrary files on the filesystem.

How to fix it

Upgrade Sangoma Asterisk to a version that resolves the path traversal in action_listcategories; apply the corresponding fixed package versions for your distribution and restart the service.

How to confirm the fix worked

Confirm the running Asterisk version matches a fixed release, review source or binary for sanitized path handling in action_listcategories, and test with known-traversal payloads in a non-production instance.

Typical attack path

1. Identify an exposed Asterisk HTTP manager or ARI endpoint
2. Craft a request to action_listcategories containing ../ sequences targeting sensitive paths
3. Observe successful file disclosure in the server response
4. Use obtained data to escalate privileges or pivot within the telephony environment

How to detect it

Inspect Asterisk HTTP access logs and manager event logs for requests to action_listcategories containing path traversal characters such as .. or %2e%2e; correlate with file access timestamps on sensitive directories.

• action_listcategories.*\.\./
• GET.*action=listcategories.*path=.*\.\.

What your security team should do

• Apply the vendor-supplied update immediately given the public disclosure
• Restrict HTTP/ARI access to trusted networks only
• Enable verbose logging for manager and ARI actions to support detection
• Review file permissions on Asterisk configuration and spool directories