Two new vulnerabilities in Mitel’s MiCollab unified communications and collaboration (UCC) platform have been identified, potentially putting enterprise data at risk. MiCollab is a widely used application that enables various forms of communication and collaboration within organizations, such as instant messaging, SMS, phone calls, video calls, file sharing, and remote desktop sharing.
One of the vulnerabilities, known as CVE-2024-35286, is a SQL injection flaw that was discovered earlier this year. This critical vulnerability scored 9.8 in the Common Vulnerability Scoring System (CVSS), allowing attackers to access sensitive business data and carry out malicious operations on the database. However, exploiting this vulnerability required specific configurations, making it less likely to be a high risk for most organizations.
In a recent blog post, researchers from watchTowr highlighted another vulnerability in MiCollab – a path traversal flaw, along with a third arbitrary file-read vulnerability. These vulnerabilities collectively posed a significant security risk, potentially compromising the confidentiality and integrity of enterprise data stored within the platform.
The researchers found that by leveraging a path normalization issue, attackers could bypass security controls and gain unauthorized access to critical components of MiCollab. This exploit, labeled as CVE-2024-41713, received a CVSS score of 7.5, further exacerbating the security concerns associated with MiCollab.
Moreover, the discovery of a zero-day vulnerability for arbitrary file-read added another layer of complexity to the exploit chain. When combined, these vulnerabilities could enable threat actors to execute a range of malicious activities within the MiCollab platform, posing a significant threat to organizations relying on its functionalities for daily operations.
According to Mayuresh Dani, manager of security research at the Qualys Threat Research Unit, there are over 10,000 publicly exposed Mitel MiCollab devices, potentially making them vulnerable to exploitation. The proof-of-concept exploit developed by watchTowr demonstrates how these vulnerabilities could be leveraged to gain unauthorized access to sensitive files, including authentication information, and compromise the security of the affected devices.
The implications of these vulnerabilities extend beyond data breaches, as attackers could exploit MiCollab to intercept communications, launch cyberattacks, or disrupt organizational operations. Callie Guenther, senior manager of cyber threat research at Critical Start, emphasized the increasing trend of attackers targeting communication platforms to gain access to sensitive systems, highlighting the need for robust security measures to mitigate such risks.
Mitel has released patches for the identified CVEs, but the arbitrary file-read vulnerability remains unpatched at the time of publication. Organizations using MiCollab are advised to ensure their systems are up to date to mitigate the risks associated with these vulnerabilities. By staying informed and implementing proactive security measures, enterprises can safeguard their data and communications from potential exploitation.