Summary

Trying to disallow shell commands to be run via the Asterisk CLI by configuring cli_permissions.conf (e.g. with the config line deny=!*) does not work which could lead to a security risk.

Details

With the file cli_permissions.conf you can deny certain commands (also with regexes) on the Asterisk CLI. However, when trying to disallow shell commands (e.g. with the config line deny=!*), the user can still execute shell commands via the Asterisk CLI.

The issue is that in main/asterisk.c:remoteconsolehandler() (and in consolehandler()), ast_safe_system is executed immediately and the call to cli.c:cli_has_permissions() is completely skipped.

PoC

Example cli_permissions.conf:

[general]
default_perm=permit
[root]
deny=!*
deny=pjsip sh*

With this config, when connecting to the Asterisk CLI remotely (asterisk -r), then !whoami for example is incorrectly permitted, while pjsip show endpoints is correctly denied.

Impact

If an administrator running an Asterisk instance relies on the cli_permissions.conf file to work and expects it to deny all attempts to execute shell commands, then this could lead to a security vulnerability.