CVE-2024-57520 Path traversal in n/a
A privileged user can exploit insecure permissions in Asterisk to create files outside the intended directory, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-57520?
CVE-2024-57520 is a critical path traversal vulnerability in n/a, published on 5 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function. NOTE: this is disputed by the Supplier because the impact is limited to creating empty files outside of the Asterisk product directory (aka directory traversal) and the attack can only be performed by a privileged user who has the ability to manage the configuration.
Weakness: CWE-732
Which versions are affected by CVE-2024-57520?
It affects 1 product.
Products include Sangoma Asterisk.
How do I fix CVE-2024-57520?
Apply the vendor's patch.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-57520 being exploited?
There is no known exploitation of CVE-2024-57520 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2025-47779 Using malformed From header can forge identity with ";" or NULL in name portion
- CVE-2025-57767 Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request
- CVE-2022-37325 Memory corruption in n/a
- CVE-2025-1131 Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation
- CVE-2025-54995 Asterisk remotely exploitable leak of RTP UDP ports and internal resources
Sources
Also known as DEBIAN-CVE-2024-57520, GHSA-4m27-833c-75q4, UBUNTU-CVE-2024-57520.