logo
DATABASE RESOURCES PRICING ABOUT US

Mitel VoIP Bug Exploited in Ransomware Attacks

2022-06-28T12:42:34

Description

Ransomware groups are abusing unpatched versions of a Linux-based Mitel VoIP (Voice over Internet Protocol) application and using it as a springboard plant malware on targeted systems. The critical remote code execution (RCE) flaw, tracked as [CVE-2022-29499](<https://nvd.nist.gov/vuln/detail/CVE-2022-29499>), was first [report by Crowdstrike](<https://www.crowdstrike.com/blog/novel-exploit-detected-in-mitel-voip-appliance/>) in April as a zero-day vulnerability and is now patched. Mitel is popularly known for providing business phone systems and unified communication as a service (UCaaS) to all forms of organizations. The Mitel focuses on VoIP technology allowing users to make phone calls using an internet connection instead of regular telephone lines. According to Crowdstrike, the vulnerability affects the Mitel MiVoice appliances SA 100, SA 400 and Virtual SA. The MiVoice provides a simple interface to bring all communications and tools together. ## **Bug Exploited to Plant Ransomware ** Researcher at Crowdstrike recently investigated a suspected ransomware attack. The team of researchers handled the intrusion quickly, but believe the involvement of the vulnerability (CVE-2022-29499) in the ransomware strike. The Crowdstrike identifies the origin of malicious activity linked to an IP address associated with a Linux-based Mitel VoIP appliance. Further analysis led to the discovery of a novel remote code exploit. “The device was taken offline and imaged for further analysis, leading to the discovery of a novel remote code execution exploit used by the threat actor to gain initial access to the environment,” Patrick Bennet [wrote in a blog post](<https://www.crowdstrike.com/blog/novel-exploit-detected-in-mitel-voip-appliance/>). The exploit involves two GET requests. The first one targets a “get_url” parameter of a PHP file and the second one originates from the device itself. “This first request was necessary because the actual vulnerable URL was restricted from receiving requests from external IP addresses,” the researcher explained. The second request executes the command injection by performing an HTTP GET request to the attacker-controlled infrastructure and runs the stored command on the attacker’s server. According to the researchers, the adversary uses the flaw to create an SSL-enabled reverse shell via the “mkfifo” command and “openssl_client” to send outbound requests from the compromised network. The “mkfifo” command is used to create a special file specified by the file parameter and can be opened by multiple processes for reading or writing purposes. Once the reverse shell was established, the attacker created a web shell named “pdf_import.php”. The original content of the web shell was not recovered but the researchers identifies a log file that includes a POST request to the same IP address that the exploit originated from. The adversary also downloaded a tunneling tool called “Chisel” onto VoIP appliances to pivot further into the network without getting detected. The Crowdstrike also identifies anti-forensic techniques performed by the threat actors to conceal the activity. “Although the threat actor deleted all files from the VoIP device’s filesystem, CrowdStrike was able to recover forensic data from the device. This included the initial undocumented exploit used to compromise the device, the tools subsequently downloaded by the threat actor to the device, and even evidence of specific anti-forensic measures taken by the threat actor,” said Bennett. Mitel released a [security advisory](<https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002>) on April 19, 2022, for MiVoice Connect versions 19.2 SP3 and earlier. While no official patch has been released yet. ## **Vulnerable Mitel Devices on Shodan** The security researcher Kevin Beaumont shared a string “http.html_hash:-1971546278” to search for vulnerable Mitel devices on the Shodan search engine in a [Twitter thread](<https://twitter.com/GossiTheDog/status/1540354721931841537>). According to Kevin, there are approximately 21,000 publicly accessible Mitel appliances worldwide, the majority of which are located in the United States, succeeded by the United Kingdom. ## **Mitel Mitigation Recommendations ** Crowdstrike recommends that organizations tighten defense mechanisms by performing threat modeling and identifying malicious activity. The researcher also advised segregating the critical assets and perimeter devices to restrict the access control in case perimeter devices are compromised. “Timely patching is critical to protect perimeter devices. However, when threat actors exploit an undocumented vulnerability, timely patching becomes irrelevant,” Bennett explained.


Related


checkpoint_advisories
info

Mitel MiVoice Connect Command Injection (CVE-2022-29499)

2022-06-27T00:00:00
rapid7blog
info

Exploitation of Mitel MiVoice Connect SA CVE-2022-29499

2022-07-07T19:09:10
rapid7blog
info

CVE-2022-36804: Easily Exploitable Vulnerability in Atlassian Bitbucket Server and Data Center

2022-09-20T15:14:26
rapid7blog
info

Active Exploitation of Multiple Vulnerabilities in Zimbra Collaboration Suite

2022-08-17T12:55:18
rapid7blog
info

What’s New in InsightVM and Nexpose: Q3 2022 in Review

2022-09-28T14:11:35
prion
NVD

CVE-2022-29499

2022-04-26T02:15:00
cve
NVD

CVE-2022-29499

2022-04-26T02:15:00
malwarebytes
blog

Timely patching is good, but sometimes it's not enough

2023-01-15T18:45:00
thn
info

Lorenz Ransomware Exploit Mitel VoIP Systems to Breach Business Networks

2022-09-14T14:04:00
thn
info

Hackers Exploit Mitel VoIP Zero-Day in Likely Ransomware Attack

2022-06-24T12:58:00
thn
info

CISA Warns of Active Exploitation of 'PwnKit' Linux Vulnerability in the Wild

2022-06-29T04:01:00
cisa_kev
info

Mitel MiVoice Connect Data Validation Vulnerability

2022-06-27T00:00:00
attackerkb
info

CVE-2022-29499

2022-04-26T00:00:00