CISA Warns of Active Exploitation in Mitel and Oracle Systems

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning about three critical vulnerabilities impacting Mitel MiCollab and Oracle WebLogic Server. These flaws have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation, urging organizations to act swiftly to mitigate risks.

The Vulnerabilities

The vulnerabilities added to the KEV catalog are:

1. CVE-2024-41713 (CVSS score: 9.1) – A path traversal vulnerability in Mitel MiCollab that enables attackers to gain unauthorized, unauthenticated access to critical resources.

2. CVE-2024-55550 (CVSS score: 4.4) – Another path traversal flaw in Mitel MiCollab, this one allowing an authenticated attacker with administrative privileges to access local files due to inadequate input sanitization.

3. CVE-2020-2883 (CVSS score: 9.8) – A high-severity security flaw in Oracle WebLogic Server that can be exploited by unauthenticated attackers with network access via IIOP or T3 protocols.

Potential Attack Vectors

The criticality of these vulnerabilities lies in their potential exploitation methods. Notably, CVE-2024-41713 can be combined with CVE-2024-55550 to allow an unauthenticated, remote attacker to access arbitrary files on the affected server. This chaining of vulnerabilities amplifies the risk and makes immediate patching essential.

Discovery and Analysis

The vulnerabilities in Mitel MiCollab were disclosed last month by WatchTowr Labs. The research team uncovered these flaws while attempting to replicate another severe issue in Mitel MiCollab, identified as CVE-2024-35286 (CVSS score: 9.8), which was patched in May 2024. These findings highlight recurring security lapses in Mitel’s systems, emphasizing the need for robust testing and secure coding practices.

CVE-2020-2883 in Oracle WebLogic Server, on the other hand, is not a new vulnerability. Oracle flagged the issue in April 2020, warning of its active exploitation in real-world attacks. Despite being an older vulnerability, its inclusion in the KEV catalog underscores the persistent threats posed by unpatched systems.

Real-World Exploitation

While CISA has not disclosed detailed information about the exploitation methods, attackers typically leverage such vulnerabilities to gain unauthorized access, exfiltrate sensitive data, or deploy malware. Organizations using Mitel MiCollab and Oracle WebLogic Server are advised to assume they could be targeted and act proactively.

Mitigation Steps

Pursuant to Binding Operational Directive (BOD) 22-01, Federal Civilian Executive Branch (FCEB) agencies must address these vulnerabilities by January 28, 2025. The following measures are recommended:

1. Apply Patches Immediately: Mitel and Oracle have released patches to address these vulnerabilities. Organizations should prioritize updating their systems to mitigate risks.

2. Conduct Security Audits: Regularly assess your systems to identify and remediate security gaps, ensuring vulnerabilities are promptly addressed.

3. Implement Network Segmentation: Limit exposure by segmenting critical systems and restricting access to only necessary personnel and applications.

4. Monitor Network Traffic: Deploy tools to detect unusual activity that may indicate exploitation attempts or unauthorized access.

5. Strengthen Access Controls: Use multi-factor authentication (MFA) and enforce the principle of least privilege to reduce the likelihood of successful exploitation.