CVE-2024-8504

What it actually does

CVE-2024-8504 is an authenticated command injection vulnerability in VICIdial. A user with low-privileged "agent" access can cause the application to pass attacker-controlled input to the operating system shell, resulting in arbitrary command execution as the root user. Because the command runs with root privileges, successful exploitation provides full host-level compromise: reading or modifying application data, changing system configuration, installing malware, creating persistence, accessing call-center recordings or credentials, and pivoting to connected systems. The issue can also be chained with CVE-2024-8503 to move from unauthenticated access to root command execution.

Why it matters to the business

A compromised VICIdial system can disrupt call-center operations, expose customer contact data and call recordings, enable toll fraud or phishing campaigns, and give an attacker control of a server that may be trusted inside the organization. The high EPSS score and weaponized exploit maturity indicate a meaningful likelihood of exploitation in the wild, even though this CVE is not currently listed in CISA KEV. Organizations running internet-accessible VICIdial should treat this as urgent because a basic agent account—or a chained unauthenticated exploit path—can lead to complete system takeover.

How an attack unfolds

An attacker first obtains access to VICIdial as an agent, either through stolen credentials, credential stuffing, phishing, exposed default credentials, or by chaining with CVE-2024-8503 where applicable. After authentication, the attacker sends a crafted request to a vulnerable VICIdial endpoint that includes shell metacharacters or command payloads in a parameter processed by server-side code. The vulnerable application invokes an operating system command without safely validating or escaping the input, causing the attacker's command to execute as root. The attacker can then run reconnaissance commands, download additional payloads, create backdoor users or SSH keys, alter web application files, dump configuration files and database credentials, exfiltrate call-center data, and use the server as a foothold for lateral movement or further attacks.

How to fix it

Upgrade VICIdial to a version that contains the vendor fix for CVE-2024-8504 as soon as an applicable fixed release is available from the vendor or distribution maintainer. Because no exact fixed versions were provided in the input, administrators should consult official VICIdial security advisories, release notes, and package repositories, and verify that the deployed build includes the command-injection fix. Also remediate CVE-2024-8503 where present, because chaining can remove the authentication requirement. Until patched, restrict VICIdial access to trusted networks or VPNs, disable direct internet exposure where possible, enforce strong unique passwords and MFA for agent accounts if supported, review and remove unnecessary agent accounts, apply least privilege to the web/application runtime, monitor for suspicious commands, and consider temporarily disabling vulnerable functionality if vendor guidance identifies a safe workaround.

How to confirm the fix worked

Confirm the deployed VICIdial version/build is newer than the vendor-fixed release and that all web nodes, application nodes, and downstream packaged deployments have been updated consistently. Review vendor release notes or source changes to verify the vulnerable command execution path has been patched with safe input handling rather than shell concatenation. From a defensive testing perspective, use an authorized non-destructive test payload that attempts to inject a harmless command such as writing a controlled marker to a temporary location, and confirm it does not execute. Validate that agent accounts cannot trigger shell command execution, that unauthenticated chaining through CVE-2024-8503 is no longer possible, and that external access controls block untrusted access to VICIdial interfaces. After patching, review file integrity, active processes, scheduled tasks, user accounts, SSH keys, and application logs to ensure the host was not already compromised before remediation.

Typical attack path

1. Identify an exposed VICIdial instance and determine whether it is vulnerable.
2. Obtain valid agent-level credentials through theft, guessing, reuse, phishing, or another vulnerability such as CVE-2024-8503.
3. Authenticate to VICIdial as an agent.
4. Send a crafted request containing command-injection syntax to the vulnerable functionality.
5. Execute operating system commands as the root user.
6. Establish persistence, such as adding users, SSH keys, cron jobs, web shells, or modified application files.
7. Access sensitive VICIdial configuration, call records, recordings, customer data, and credentials.
8. Use the compromised server for data theft, service disruption, toll fraud, phishing, malware deployment, or lateral movement.

How to detect it

To determine whether exploitation already occurred, review VICIdial web access logs, application logs, authentication logs, web server error logs, system auth logs, shell history, process execution telemetry, EDR events, cron directories, systemd units, SSH configuration, and file integrity monitoring. Look for agent logins followed by unusual HTTP requests containing shell metacharacters, URL-encoded command separators, command substitution syntax, or payloads referencing common tools such as curl, wget, bash, sh, nc, perl, python, php, or busybox. Correlate suspicious requests with process creation where the web server or VICIdial runtime spawned shell interpreters or administrative commands. Investigate any commands executed as root around the time of suspicious web requests, especially outbound downloads, reverse shells, user creation, permission changes, archive creation, database dumps, or access to call recordings and configuration files. Because this vulnerability can be chained from unauthenticated access via CVE-2024-8503, also review unauthenticated request patterns immediately preceding agent session creation or command-like requests. Pay particular attention to new or modified files under web-accessible directories, unexpected root cron entries, new SSH keys, unfamiliar privileged users, outbound connections to rare external IPs, and evidence of data staging or exfiltration.

• ;id
• %3Bid
• ;whoami
• %3Bwhoami
• ;uname -a
• %3Buname%20-a
• ;cat /etc/passwd
• %3Bcat%20/etc/passwd
• $(id)
• %24%28id%29
• `id`
• %60id%60
• /bin/sh -c
• /bin/bash -c
• sh -i
• bash -i
• /dev/tcp/
• curl http
• curl -fsSL
• wget http
• wget -O-
• nc -e
• ncat -e
• python -c
• python3 -c
• perl -e
• php -r
• busybox wget
• chmod +x
• chattr +i
• crontab -e
• /etc/cron.d/
• /var/spool/cron/
• /root/.ssh/authorized_keys
• /etc/passwd
• /etc/shadow
• useradd
• adduser
• usermod
• sudoers
• /etc/sudoers
• tar czf
• mysqldump
• /var/log/asterisk/
• /var/www/html/
• /srv/www/htdocs/
• /tmp/
• /var/tmp/
• /dev/shm/

What your security team should do

• Prioritize internet-exposed VICIdial instances for emergency review because the vulnerability has weaponized exploit maturity and a high EPSS probability.
• Patch or upgrade VICIdial using official vendor guidance, and verify that CVE-2024-8504 and chainable CVE-2024-8503 are both remediated.
• Immediately inventory all VICIdial deployments, including appliances, cloud images, managed call-center servers, and downstream packaged installs.
• Restrict VICIdial administrative and agent interfaces to trusted networks or VPNs; remove direct public exposure wherever possible.
• Rotate VICIdial agent, admin, database, SIP, and operating system credentials if compromise is suspected or if the system was internet-facing while vulnerable.
• Audit all agent accounts for suspicious creation, privilege changes, unusual login times, and unexpected source IP addresses.
• Hunt for post-exploitation artifacts such as unexpected root-owned files, web shells, cron jobs, new users, SSH authorized_keys entries, outbound download commands, and reverse-shell activity.
• Increase monitoring for suspicious shell execution by the web server or VICIdial application user, especially commands spawning from HTTP request handling.
• Preserve logs and forensic artifacts before rebuilding or patching systems that show signs of compromise.
• If exploitation is confirmed, rebuild affected servers from known-good media, restore clean application data, rotate all secrets accessible from the host, and investigate lateral movement.