Critical Mitel MiCollab Flaw Exposes Systems to Unauthorized File and Admin Access
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-41713 | Unauthenticated Path Traversal in Mitel MiCollab NuPoint Unified Messaging CVE-2024-41713 is a path traversal vulnerability (CWE-22) in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201), caused by insufficient input validation. An unauthenticated remote attacker can send crafted requests that traverse the file system without needing credentials or user interaction. A successful exploit grants unauthorized access allowing the attacker to view, corrupt, or delete users' data and system configurations, and reporting indicates exposure to unauthorized file and administrative access. Any organization running an affected MiCollab version, particularly with the NPM component reachable from untrusted networks, is at risk. Exploitation is confirmed in the wild: CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2025-01-07 with known ransomware use, and EPSS places it in the top percentile with a 98.1% probability of exploitation within 30 days. Do: Upgrade MiCollab to a release later than 9.8 SP1 FP2 (9.8.1.201) per Mitel's advisory; if patching is not immediately possible, apply the vendor's mitigations or restrict/discontinue use of the NPM component, especially where it is internet-facing, as required by the CISA KEV entry. Given known ransomware use and reported admin-access abuse, hunt for signs of exploitation on exposed MiCollab servers (unexpected file changes, configuration tampering, and follow-on lateral movement). | 9.1 group max | 98% | KEV ransomware |
| largeon the order of tens of thousands of enterprise deployments, with thousands of MiCollab instances likely internet-exposed | |
| CVE-2024-52544 | An unauthenticated attacker can trigger a stack based buffer overflow in the DP Service (TCP port 3500). An unauthenticated attacker can trigger a stack based buffer overflow in the DP Service (TCP port 3500). This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111. NVD description · AI analysis pending | 9.8 | 1% | — | — | ||
| CVE-2024-52548 | An attacker who can execute arbitrary Operating Systems commands, can bypass code signing enforcements in the kernel, and execute arbitrary native code. An attacker who can execute arbitrary Operating Systems commands, can bypass code signing enforcements in the kernel, and execute arbitrary native code. This vulnerability has been resolved in firmware version 2.800.0000000.8.R.20241111. NVD description · AI analysis pending | 6.7 | <1% | — | — | ||
| CVE-2024-55550 | Authenticated Path Traversal in Mitel MiCollab Enables Local File Reading Mitel MiCollab contains a path traversal vulnerability (CWE-22) caused by insufficient input sanitization of file-path input. It is triggered when an authenticated user with administrative privileges submits crafted paths that escape the intended directory, allowing the attacker to read local files on the MiCollab server. On its own the flaw requires admin credentials, but it can be chained with CVE-2024-41713, an unauthenticated remote arbitrary file-read flaw in the same product, enabling remote attackers to read files without valid credentials. Any organization running Mitel MiCollab is affected; the available data does not specify affected or fixed version ranges. The vulnerability was added to CISA's Known Exploited Vulnerabilities catalog on 2025-01-07 with known ransomware use, although no public proof-of-concept is known. Do: Apply Mitel's updates or mitigations per the vendor advisory immediately, prioritizing internet-facing MiCollab servers, and address the chained CVE-2024-41713 issue in the same maintenance cycle; where mitigations are unavailable, restrict or discontinue use per CISA KEV guidance. Check the Mitel advisory for exact fixed versions (not provided here), limit administrative access to trusted users, and review server logs for evidence of arbitrary file reads or follow-on ransomware activity. | 2.7 | 38% | KEV ransomware |
| moderatethousands of internet-exposed MiCollab servers (roughly 1k-10k instances) |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| ipv4 | 9.8.1.5 | late May 2024 with the release of MiCollab version 9.8 SP1 (9.8.1.5). What makes the new vulnerability notable is that it invol |
| ipv4 | 9.8.2.12 | E-2024-41713 has been plugged in MiCollab versions 9.8 SP2 (9.8.2.12) or later as of October 9, 2024. "On a more technical level |
Full article725 words · extracted from thehackernews.com · click to collapse
Cybersecurity researchers have released a proof-of-concept (PoC) exploit that strings together a now-patched critical security flaw impacting Mitel MiCollab with an arbitrary file read zero-day, granting an attacker the ability to access files from susceptible instances.
The critical vulnerability in question is CVE-2024-41713 (CVSS score: 9.8), which relates to a case of insufficient input validation in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab that results in a path traversal attack.
MiCollab is a software and hardware solution that integrates chat, voice, video, and SMS messaging with Microsoft Teams and other applications. NPM is a server-based voicemail system, which enables users to access their voice messages through various methods, including remotely or through the Microsoft Outlook client.
WatchTowr Labs, in a report shared with The Hacker News, said it discovered CVE-2024-41713 as part of its efforts to reproduce CVE-2024-35286 (CVSS score: 9.8), another critical bug in the NPM component that could permit an attacker to access sensitive information and execute arbitrary database and management operations.
The SQL injection flaw was patched by Mitel in late May 2024 with the release of MiCollab version 9.8 SP1 (9.8.1.5).
What makes the new vulnerability notable is that it involves passing the input "..;/" in the HTTP request to the ReconcileWizard component to land the attacker in the root of the application server, thus making it possible to access sensitive information (e.g., /etc/passwd) sans authentication.
WatchTowr Labs' analysis further found that the authentication bypass could be chained with an as-yet-unpatched post-authentication arbitrary file read flaw to extract sensitive information.
"A successful exploit of this vulnerability could allow an attacker to gain unauthorized access, with potential impacts to the confidentiality, integrity, and availability of the system," Mitel said in an advisory for CVE-2024-41713.
"If the vulnerability is successfully exploited, an attacker could gain unauthenticated access to provisioning information including non-sensitive user and network information, and perform unauthorized administrative actions on the MiCollab Server."
The company also noted that the local file read flaw (CVE-2024-55550, CVSS score: 2.7) within the system is the result of insufficient input sanitization, and that the disclosure is limited to non-sensitive system information. It emphasized that the vulnerability does not allow file modification or privilege escalation.
Following responsible disclosure, CVE-2024-41713 has been plugged in MiCollab versions 9.8 SP2 (9.8.2.12) or later as of October 9, 2024.
"On a more technical level, this investigation has demonstrated some valuable lessons," security researcher Sonny Macdonald said.
"Firstly, it has acted as a real-world example that full access to the source code is not always needed – even when diving into vulnerability research to reproduce a known weakness in a COTS solution. Depending on the depth of the CVE description, some good Internet search skills can be the basis for a successful hunt for vulnerabilities."
It's worth noting that MiCollab 9.8 SP2 (9.8.2.12) also addresses a separate SQL injection vulnerability in the Audio, Web, and Video Conferencing (AWV) component (CVE-2024-47223, CVSS score: 9.4) that could have severe impacts, ranging from information disclosure to execution of arbitrary database queries that could render the system inoperable.
The disclosure comes as Rapid7 detailed several security defects in the Lorex 2K Indoor Wi-Fi Security Camera (from CVE-2024-52544 through CVE-2024-52548) that could be combined to achieve remote code execution (RCE).
In a hypothetical attack scenario, the first three vulnerabilities could be utilized to reset a target device's admin password to one of the adversary's choosing, leveraging the access to view live video and audio feeds from the device, or leverage the remaining two flaws to achieve RCE with elevated privileges.
"The exploit chain consists of five distinct vulnerabilities, which operate together in two phases to achieve unauthenticated RCE," security researcher Stephen Fewer noted.
"Phase 1 performs an authentication bypass, allowing a remote unauthenticated attacker to reset the device's admin password to a password of the attacker's choosing. Phase 2 achieves remote code execution by leveraging the auth bypass in phase 1 to perform an authenticated stack-based buffer overflow and execute an operating system (OS) command with root privileges."
Update
Data shared by attack surface management company Censys shows that there are 8,899 exposed Mitel MiCollab instances as of December 17, 2024, with 54% of them geolocated in the United States.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/12/critical-mitel-micollab-flaw-exposes.html