2006.1 - directory traversal in Asterisk@Home

ID     :           2006.1
Product :          ARI (Asterisk Recording Interface)
                   http://www.littlejohnconsulting.com/?q=node/11
                   Asterisk@home Distribution 
                   http://asteriskathome.sourceforge.net/
Affected product : <= 0.7.15 (Asterisk@Home 2.6 and lower)
Class :            Access to protected information
Remote :           yes
Author :           Francois Harvey <fharvey at securiweb dot net>
Published date :   20/04/2006 (Initial Vendor contact 2006-03-06)
Solution :         Use the last ARI version or use asterisk@home 2.8

Summary

Two vulnerabilities was found in the ARI package included in the asterisk@home Distribution. These vulnerability are also present in a stand alone installation.

Vulnerability 1

The config file is in a public directory

exploit
http://<asterisk>/recordings/includes/main.conf

This should list all the configuration of ARI. With asterisk password, db password, admin password.

Vulnerability 2

A directory traversal/file retreival exist in the ARI web interface.

This script allow a user to download any mp3/wav/gsm on the system. No authentification is needed, this can be used to listen voicemail from another user.

Exploit
http://<asterisk>/recordings/misc/audio.php?recording=/var/spool/asterisk/voicemail/default/<mailbox>/INBOX/msg<messageid>.wav

This flaw can also be used to verify the presence of a file on the server

Cannot use file: xxx <-- file exist
404 File not found! <--- file doesn't exist

Patch

Both asterisk@home and ARI released fixes

Author

Francois Harvey <fharvey at securiweb dot net>
SecuriWeb inc | www.securiweb.net