Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes

Overview

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated Asterisk REST Interface (ARI) attacker with read-only privileges may use setChannelVar to execute write dialplan functions, including FILE() writes, even when live_dangerously in asterisk.conf is set to no. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid read-only ARI credentials. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

Affected

• asterisk < 20.20.1
• asterisk >= 21.0.0-pre1, < 21.12.3
• asterisk >= 22.0.0-pre1, < 22.10.1
• asterisk >= 23.0.0-pre1, < 23.4.1
• certified-asterisk < 20.7-cert11
• certified-asterisk >= 22.8-cert1-pre1, < 22.8-cert3

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.