Mitel Patches Severe MiCollab Flaw Allowing Admin Access

A critical vulnerability in Mitel’s MiCollab software, now patched, has been revealed to enable attackers to gain unauthorized access to sensitive files and administrative controls. The vulnerability, tracked as CVE-2024-41713, has a CVSS score of 9.8, emphasizing its severity. This flaw, combined with an unpatched post-authentication arbitrary file read vulnerability, could allow attackers to compromise affected systems.

Mitel’s MiCollab is a widely used communications platform integrating voice, chat, video, and SMS messaging, and it connects seamlessly with Microsoft Teams. Its NuPoint Unified Messaging (NPM) component, which manages voicemail, is at the center of this vulnerability.

CVE-2024-41713

The vulnerability stems from insufficient input validation in the NPM component, which allows a path traversal attack. By manipulating an HTTP request sent to the platform’s ReconcileWizard component with specific input ("..;/"), attackers can access sensitive files like /etc/passwd without authentication. This unauthorized access can expose sensitive information critical to the system’s security posture.

Cybersecurity firm WatchTowr Labs discovered this vulnerability while reproducing another critical bug in the same component—CVE-2024-35286. Both flaws were marked critical, as they allow attackers to access sensitive data and perform unauthorized database and system operations.

Post-Exploitation Implications

Exploiting CVE-2024-41713 can lead to:

1. Unauthenticated Access: Attackers can retrieve provisioning details, including non-sensitive user and network data.
2. Administrative Actions: Exploitation enables unauthorized administrative control over MiCollab servers.
3. Chained Exploits: The flaw can be combined with an arbitrary file read vulnerability (pending a CVE assignment) to extract additional sensitive data. This chaining heightens the potential impact on confidentiality, integrity, and availability.

Mitigations

Mitel addressed CVE-2024-41713 with the release of MiCollab version 9.8 SP2 (9.8.2.12) on October 9, 2024. This update resolves the vulnerability by enhancing input validation and sanitization. Additionally, the update fixes another critical vulnerability, CVE-2024-47223, an SQL injection flaw in the Audio, Web, and Video Conferencing (AWV) component, which could enable database query manipulation.

Despite the fix, the company emphasized that the local file read flaw, though exploitable, discloses only non-sensitive information and does not allow file modification or privilege escalation. This mitigates its immediate risk but underscores the need for proactive patching.

Lessons Learned

Security researcher Sonny Macdonald, reflecting on the discovery, highlighted the significance of understanding CVE descriptions and leveraging publicly available information.

“Full access to source code isn’t always necessary for vulnerability research,” Macdonald explained. “With detailed CVE documentation and good search skills, identifying and reproducing weaknesses in commercial off-the-shelf (COTS) software is feasible.”

Implications

The discovery of CVE-2024-41713 underscores a larger issue in commercial software: the potential for critical vulnerabilities to remain exploitable in real-world settings. As seen in other recent disclosures, unpatched flaws in internet-connected devices and software continue to pose significant risks.

For example, cybersecurity firm Rapid7 recently disclosed vulnerabilities in Lorex 2K Indoor Wi-Fi Security Cameras. These flaws (CVE-2024-52544 to CVE-2024-52548) allow attackers to achieve remote code execution (RCE) through a two-phase exploit chain. Similar to Mitel’s case, authentication bypasses and improper input handling facilitated these exploits.