Exploit PoC Validates MiCollab Zero-Day Flaw Risks

 

A zero-day arbitrary file read vulnerability found in Mitel MiCollab has raised significant concerns about data security. Attackers can exploit this flaw and chain it with a critical bug (CVE-2024-35286) to access sensitive data stored on vulnerable instances of the platform. Mitel MiCollab is a cross-platform collaboration tool offering services such as instant messaging, SMS, voice and video calls, file sharing, and remote desktop sharing, designed to enhance workplace collaboration without verbal communication.

The Risks of Collaboration Platform Vulnerabilities

Data storage and handling of sensitive information are integral to modern organizations' operations. According to WatchTower researchers, the Mitel MiCollab platform has a zero-day vulnerability that allows attackers to perform arbitrary file reads. However, to exploit this issue, attackers require access to the server's filesystem. The vulnerability impacts a range of businesses, from large corporations to SMEs and remote or hybrid workforce setups, all relying on MiCollab for unified communication.

WatchTower reported the issue to Mitel on August 26, 2024, but after 90 days without a fix, the vulnerability remains unresolved. A report by WatchTower revealed that more than 16,000 MiCollab instances accessible via the internet are affected. Despite the lack of a CVE number assigned to the flaw, attackers can inject path traversals via the 'ReconcileWizard' servlet, exploiting the 'reportName' parameter in API requests. This facilitates unauthorized access to restricted files, posing a critical security threat.

Combining Vulnerabilities for Exploitation

The vulnerability gains heightened severity when paired with CVE-2024-35286 (CVSS score 9.8), a critical path traversal flaw that enables authentication bypass. Additionally, CVE-2024-41713, another zero-day issue identified by researchers, allows arbitrary file reading. Together, these flaws enable attackers to gain system visibility, perform malicious operations, and propagate file access across systems. Proof-of-concept (PoC) exploit code for this chain has been published by WatchTower on GitHub.

While the newer vulnerability is technically less critical than the others, it still poses a significant threat by granting unauthorized access to sensitive files. Recent incidents show that threat actors have targeted MiCollab, underlining the urgent need for mitigation measures. Organizations using MiCollab must act promptly to address this risk.

Mitigating the Threat

Until Mitel releases a patch for this zero-day flaw, organizations are advised to:

1. Update MiCollab to the Latest Version
   Install version 9.8 service pack 2 (9.8.2.12) or later, which addresses other known vulnerabilities such as CVE-2024-41713.
2. Restrict Server Access
   Limit access to trusted IP ranges and internal networks, and implement firewall rules to block unauthorized access.
3. Monitor Log Files
   Check for path traversal patterns that might indicate exploitation attempts.
4. Disable the Vulnerable Servlet
   If feasible, disable the 'ReconcileWizard' servlet to prevent exploitation of the flaw.

The Broader Impact

As security risks related to MiCollab persist, reports indicate that the collaboration platform has been targeted by a group of threat actors, allegedly linked to "Salt Typhoon," a Chinese intelligence operation. These attacks have affected US telecommunications firms, including Verizon, AT&T, and T-Mobile, exposing sensitive customer data.

Organizations must adopt robust security practices to mitigate risks while waiting for Mitel to address these vulnerabilities. Proactively safeguarding sensitive systems and implementing strict access controls are essential for minimizing exposure. By combining organizational vigilance with updated software practices, businesses can navigate these challenges and protect critical infrastructure from exploitation.