一、 漏洞 CVE-2021-37624 基础信息
漏洞标题
FreeSWITCH 不验证 SIP 消息请求，导致垃圾邮件和消息伪影
来源：AIGC 神龙大模型
漏洞描述信息
FreeSWITCH不验证SIP MESSAGE请求，导致垃圾信息和消息伪装
来源：AIGC 神龙大模型
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
来源：AIGC 神龙大模型
漏洞类别
N/A
来源：AIGC 神龙大模型
漏洞标题
FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing
来源：美国国家漏洞数据库 NVD
漏洞描述信息
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.7, FreeSWITCH does not authenticate SIP MESSAGE requests, leading to spam and message spoofing. By default, SIP requests of the type MESSAGE (RFC 3428) are not authenticated in the affected versions of FreeSWITCH. MESSAGE requests are relayed to SIP user agents registered with the FreeSWITCH server without requiring any authentication. Although this behaviour can be changed by setting the `auth-messages` parameter to `true`, it is not the default setting. Abuse of this security issue allows attackers to send SIP MESSAGE messages to any SIP user agent that is registered with the server without requiring authentication. Additionally, since no authentication is required, chat messages can be spoofed to appear to come from trusted entities. Therefore, abuse can lead to spam and enable social engineering, phishing and similar attacks. This issue is patched in version 1.10.7. Maintainers recommend that this SIP message type is authenticated by default so that FreeSWITCH administrators do not need to be explicitly set the `auth-messages` parameter. When following such a recommendation, a new parameter can be introduced to explicitly disable authentication.
来源：美国国家漏洞数据库 NVD
CVSS信息
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
来源：美国国家漏洞数据库 NVD
漏洞类别
认证机制不恰当
来源：美国国家漏洞数据库 NVD
漏洞标题
FreeSWITCH 访问控制错误漏洞
来源：中国国家信息安全漏洞库 CNNVD
漏洞描述信息
FreeSWITCH是美国Anthony Minessale个人开发者的研发的一套免费、开源的通信软件。该软件可用于创建音、视频以及短消息类产品和应用。 FreeSWITCH 1.10.7之前版本存在访问控制错误漏洞，未经身份验证的攻击者可以将"SIP MESSAGE"消息发送到任何注册到服务器的SIP用户代理。
来源：中国国家信息安全漏洞库 CNNVD
CVSS信息
N/A
来源：中国国家信息安全漏洞库 CNNVD
漏洞类别
授权问题
来源：中国国家信息安全漏洞库 CNNVD
二、漏洞 CVE-2021-37624 的公开POC
# POC 描述 源链接 神龙链接
1 A FreeSWITCH specific scanning and exploitation toolkit for CVE-2021-37624 and CVE-2021-41157. https://github.com/0xInfection/PewSWITCH POC详情
三、漏洞 CVE-2021-37624 的情报信息