{"id":"CVE-2024-42365","summary":"Asterisk allows `Write=originate` as sufficient permissions for code execution / `System()` dialplan","details":"Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with `write=originate` may change all configuration files in the `/etc/asterisk/` directory. This occurs because they are able to curl remote files and write them to disk, but are also able to append to existing files using the `FILE` function inside the `SET` application. This issue may result in privilege escalation, remote code execution and/or blind server-side request forgery with arbitrary protocol. Asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2 contain a fix for this issue.","aliases":["GHSA-c4cg-9275-6w44"],"modified":"2026-08-12T14:52:13.111293Z","published":"2024-08-08T16:29:07.436Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1220","CWE-267"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42365.json"},"references":[{"type":"WEB","url":"https://github.com/asterisk/asterisk/blob/14367caaf7241df1eceea7c45c5b261989c2c6db/main/manager.c#L6426"},{"type":"WEB","url":"https://github.com/asterisk/asterisk/blob/7d28165cb1b2d02d66e8693bd3fe23ee72fc55d8/main/manager.c#L6426"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/10/msg00016.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42365.json"},{"type":"ADVISORY","url":"https://github.com/asterisk/asterisk/security/advisories/GHSA-c4cg-9275-6w44"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42365"},{"type":"FIX","url":"https://github.com/asterisk/asterisk/commit/42a2f4ccfa2c7062a15063e765916b3332e34cc4"},{"type":"FIX","url":"https://github.com/asterisk/asterisk/commit/7a0090325bfa9d778a39ae5f7d0a98109e4651c8"},{"type":"FIX","url":"https://github.com/asterisk/asterisk/commit/b4063bf756272254b160b6d1bd6e9a3f8e16cc71"},{"type":"FIX","url":"https://github.com/asterisk/asterisk/commit/bbe68db10ab8a80c29db383e4dfe14f6eafaf993"},{"type":"FIX","url":"https://github.com/asterisk/asterisk/commit/faddd99f2b9408b524e5eb8a01589fe1fa282df2"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/asterisk/asterisk","events":[{"introduced":"fdde690e0fa2e58bf45ea2bf83962bb1c261d6e0"},{"fixed":"42a2f4ccfa2c7062a15063e765916b3332e34cc4"},{"fixed":"7a0090325bfa9d778a39ae5f7d0a98109e4651c8"},{"fixed":"b4063bf756272254b160b6d1bd6e9a3f8e16cc71"},{"fixed":"bbe68db10ab8a80c29db383e4dfe14f6eafaf993"},{"fixed":"faddd99f2b9408b524e5eb8a01589fe1fa282df2"}],"database_specific":{"cpe":["cpe:2.3:a:asterisk:certified_asterisk:13.13.0:*:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:13.13.0:rc1:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:13.13.0:rc2:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc1:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc2:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc3:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc4:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8:cert1-rc5:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8:cert10:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8:cert11:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8:cert12:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8:cert13:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8:cert14:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc1:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc2:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc3:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8:cert4-rc4:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:16.8.0:-:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:18.9:cert1:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:18.9:cert1-rc1:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:18.9:cert10:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:18.9:cert2:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:18.9:cert3:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:18.9:cert4:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:18.9:cert5:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:18.9:cert6:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:18.9:cert7:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:18.9:cert8:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:18.9:cert8-rc1:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:18.9:cert8-rc2:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:18.9:cert9:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:20.7:cert1:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:20.7:cert1-rc1:*:*:*:*:*:*","cpe:2.3:a:asterisk:certified_asterisk:20.7:cert1-rc2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"13.13.0"},{"last_affected":"13.13.0"},{"introduced":"13.13.0-rc1"},{"last_affected":"13.13.0-rc1"},{"introduced":"13.13.0-rc2"},{"last_affected":"13.13.0-rc2"},{"introduced":"16.8-cert1\\-rc1"},{"last_affected":"16.8-cert1\\-rc1"},{"introduced":"16.8-cert1\\-rc2"},{"last_affected":"16.8-cert1\\-rc2"},{"introduced":"16.8-cert1\\-rc3"},{"last_affected":"16.8-cert1\\-rc3"},{"introduced":"16.8-cert1\\-rc4"},{"last_affected":"16.8-cert1\\-rc4"},{"introduced":"16.8-cert1\\-rc5"},{"last_affected":"16.8-cert1\\-rc5"},{"introduced":"16.8-cert10"},{"last_affected":"16.8-cert10"},{"introduced":"16.8-cert11"},{"last_affected":"16.8-cert11"},{"introduced":"16.8-cert12"},{"last_affected":"16.8-cert12"},{"introduced":"16.8-cert13"},{"last_affected":"16.8-cert13"},{"introduced":"16.8-cert14"},{"last_affected":"16.8-cert14"},{"introduced":"16.8-cert4\\-rc1"},{"last_affected":"16.8-cert4\\-rc1"},{"introduced":"16.8-cert4\\-rc2"},{"last_affected":"16.8-cert4\\-rc2"},{"introduced":"16.8-cert4\\-rc3"},{"last_affected":"16.8-cert4\\-rc3"},{"introduced":"16.8-cert4\\-rc4"},{"last_affected":"16.8-cert4\\-rc4"},{"introduced":"16.8.0-NA"},{"last_affected":"16.8.0-NA"},{"introduced":"18.9-cert1"},{"last_affected":"18.9-cert1"},{"introduced":"18.9-cert1\\-rc1"},{"last_affected":"18.9-cert1\\-rc1"},{"introduced":"18.9-cert10"},{"last_affected":"18.9-cert10"},{"introduced":"18.9-cert2"},{"last_affected":"18.9-cert2"},{"introduced":"18.9-cert3"},{"last_affected":"18.9-cert3"},{"introduced":"18.9-cert4"},{"last_affected":"18.9-cert4"},{"introduced":"18.9-cert5"},{"last_affected":"18.9-cert5"},{"introduced":"18.9-cert6"},{"last_affected":"18.9-cert6"},{"introduced":"18.9-cert7"},{"last_affected":"18.9-cert7"},{"introduced":"18.9-cert8"},{"last_affected":"18.9-cert8"},{"introduced":"18.9-cert8\\-rc1"},{"last_affected":"18.9-cert8\\-rc1"},{"introduced":"18.9-cert8\\-rc2"},{"last_affected":"18.9-cert8\\-rc2"},{"introduced":"18.9-cert9"},{"last_affected":"18.9-cert9"},{"introduced":"20.7-cert1"},{"last_affected":"20.7-cert1"},{"introduced":"20.7-cert1\\-rc1"},{"last_affected":"20.7-cert1\\-rc1"},{"introduced":"20.7-cert1\\-rc2"},{"last_affected":"20.7-cert1\\-rc2"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["13.13.0","13.13.0-rc1","13.13.0-rc2","16.8-cert10","16.8-cert11","16.8-cert12","16.8-cert13","16.8-cert14","16.8-cert1\\-rc1","16.8-cert1\\-rc2","16.8-cert1\\-rc3","16.8-cert1\\-rc4","16.8-cert1\\-rc5","16.8-cert4\\-rc1","16.8-cert4\\-rc2","16.8-cert4\\-rc3","16.8-cert4\\-rc4","16.8.0-NA","18.9-cert1","18.9-cert10","18.9-cert1\\-rc1","18.9-cert2","18.9-cert3","18.9-cert4","18.9-cert5","18.9-cert6","18.9-cert7","18.9-cert8","18.9-cert8\\-rc1","18.9-cert8\\-rc2","18.9-cert9","20.7-cert1","20.7-cert1\\-rc1","20.7-cert1\\-rc2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42365.json","vanir_signatures_modified":"2026-08-12T14:52:13Z","vanir_signatures":[{"signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/faddd99f2b9408b524e5eb8a01589fe1fa282df2","target":{"file":"main/manager.c"},"deprecated":false,"digest":{"line_hashes":["330083386143230897860645627042872122397","135458073016617245683244807501187529424","60033089452914022413512870798842650543","316824714912647114610842803631927843330","274807132997725124570029074467748754423","295927908401415594913179399400800381275","247155707204245380668433602252893744860","144401246708952014752911080933458126352","103597149692434822907490553740580318234","43733839804770866268421438718883615057","174688976415292125217161812871754725646","272116292709699004460503924397067593483","2776275004956605641158109646656848331","187524471302074971220675724334739476446","101928226929111395888281062233454403917","138985238550026917485626545431846360826","260379234745971463118281333239484257831","306713559133014621805675062700540987106","44505279969845405466588382943414654232","12844842932451369550652892076403609271","100835194887530738481442659800828727660"],"threshold":0.9},"id":"CVE-2024-42365-1534683e","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/42a2f4ccfa2c7062a15063e765916b3332e34cc4","target":{"file":"main/manager.c","function":"action_originate"},"deprecated":false,"digest":{"function_hash":"232703403506518374731596977575200181777","length":5343},"id":"CVE-2024-42365-41137e8e","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/b4063bf756272254b160b6d1bd6e9a3f8e16cc71","target":{"file":"main/manager.c","function":"action_originate"},"deprecated":false,"digest":{"function_hash":"23455742690250586586237669831117773691","length":5407},"id":"CVE-2024-42365-460eda08","signature_type":"Function"},{"id":"CVE-2024-42365-5803e02b","signature_type":"Line","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/7a0090325bfa9d778a39ae5f7d0a98109e4651c8","target":{"file":"main/manager.c"},"deprecated":false,"digest":{"line_hashes":["330083386143230897860645627042872122397","135458073016617245683244807501187529424","60033089452914022413512870798842650543","316824714912647114610842803631927843330","274807132997725124570029074467748754423","295927908401415594913179399400800381275","247155707204245380668433602252893744860","144401246708952014752911080933458126352","103597149692434822907490553740580318234","43733839804770866268421438718883615057","174688976415292125217161812871754725646","272116292709699004460503924397067593483","2776275004956605641158109646656848331","187524471302074971220675724334739476446","101928226929111395888281062233454403917","138985238550026917485626545431846360826","260379234745971463118281333239484257831","306713559133014621805675062700540987106","44505279969845405466588382943414654232","12844842932451369550652892076403609271","100835194887530738481442659800828727660"],"threshold":0.9}},{"source":"https://github.com/asterisk/asterisk/commit/b4063bf756272254b160b6d1bd6e9a3f8e16cc71","target":{"file":"main/manager.c"},"deprecated":false,"digest":{"line_hashes":["330083386143230897860645627042872122397","135458073016617245683244807501187529424","60033089452914022413512870798842650543","316824714912647114610842803631927843330","274807132997725124570029074467748754423","295927908401415594913179399400800381275","247155707204245380668433602252893744860","144401246708952014752911080933458126352","103597149692434822907490553740580318234","43733839804770866268421438718883615057","174688976415292125217161812871754725646","272116292709699004460503924397067593483","2776275004956605641158109646656848331","187524471302074971220675724334739476446","101928226929111395888281062233454403917","138985238550026917485626545431846360826","260379234745971463118281333239484257831","306713559133014621805675062700540987106","44505279969845405466588382943414654232","12844842932451369550652892076403609271","100835194887530738481442659800828727660"],"threshold":0.9},"id":"CVE-2024-42365-739da863","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["330083386143230897860645627042872122397","135458073016617245683244807501187529424","60033089452914022413512870798842650543","316824714912647114610842803631927843330","274807132997725124570029074467748754423","295927908401415594913179399400800381275","247155707204245380668433602252893744860","144401246708952014752911080933458126352","103597149692434822907490553740580318234","43733839804770866268421438718883615057","174688976415292125217161812871754725646","272116292709699004460503924397067593483","2776275004956605641158109646656848331","187524471302074971220675724334739476446","101928226929111395888281062233454403917","138985238550026917485626545431846360826","260379234745971463118281333239484257831","306713559133014621805675062700540987106","44505279969845405466588382943414654232","12844842932451369550652892076403609271","100835194887530738481442659800828727660"]},"id":"CVE-2024-42365-77e90d27","signature_type":"Line","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/bbe68db10ab8a80c29db383e4dfe14f6eafaf993","target":{"file":"main/manager.c"}},{"signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/42a2f4ccfa2c7062a15063e765916b3332e34cc4","target":{"file":"main/manager.c"},"deprecated":false,"digest":{"line_hashes":["330083386143230897860645627042872122397","135458073016617245683244807501187529424","60033089452914022413512870798842650543","316824714912647114610842803631927843330","274807132997725124570029074467748754423","295927908401415594913179399400800381275","247155707204245380668433602252893744860","144401246708952014752911080933458126352","103597149692434822907490553740580318234","43733839804770866268421438718883615057","174688976415292125217161812871754725646","272116292709699004460503924397067593483","2776275004956605641158109646656848331","187524471302074971220675724334739476446","101928226929111395888281062233454403917","138985238550026917485626545431846360826","260379234745971463118281333239484257831","306713559133014621805675062700540987106","44505279969845405466588382943414654232","12844842932451369550652892076403609271","100835194887530738481442659800828727660"],"threshold":0.9},"id":"CVE-2024-42365-7e6e8c38","signature_type":"Line"},{"id":"CVE-2024-42365-af28066f","signature_type":"Function","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/faddd99f2b9408b524e5eb8a01589fe1fa282df2","target":{"file":"main/manager.c","function":"action_originate"},"deprecated":false,"digest":{"function_hash":"23455742690250586586237669831117773691","length":5407}},{"target":{"file":"main/manager.c","function":"action_originate"},"deprecated":false,"digest":{"length":5366,"function_hash":"252776182087257656298008582200932970026"},"id":"CVE-2024-42365-bff90075","signature_type":"Function","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/7a0090325bfa9d778a39ae5f7d0a98109e4651c8"},{"target":{"function":"action_originate","file":"main/manager.c"},"deprecated":false,"digest":{"function_hash":"23455742690250586586237669831117773691","length":5407},"id":"CVE-2024-42365-eb29ef81","signature_type":"Function","signature_version":"v1","source":"https://github.com/asterisk/asterisk/commit/bbe68db10ab8a80c29db383e4dfe14f6eafaf993"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L"}]}