Path Traversal in Mitel MiCollab NuPoint Unified Messaging

This repository provides a proof-of-concept (PoC) exploit for CVE-2024-41713, a directory traversal and arbitrary file read vulnerability in Mitel MiCollab. The main exploit is implemented as a Bash script (cve-2024-41713-exploit.sh) that sends a crafted HTTP POST request to a vulnerable endpoint on the target MiCollab server. The request abuses path traversal in the endpoint to read the /etc/passwd file. The script then parses the response to extract and display the list of user accounts. The repository contains two files: a README.md with usage instructions and sample output, and the exploit script itself. The exploit is network-based, requires the attacker to specify the target's address, and demonstrates the ability to read arbitrary files from the server. No payload customization or advanced post-exploitation is present, making this a typical PoC exploit.

This repository contains a Python exploit script and a README for CVE-2024-41713, targeting Mitel MiCollab (version 9.8 SP1 FP2 and earlier). The exploit leverages an authentication bypass and path traversal vulnerability to read arbitrary files from the target server. The script takes two arguments: the target URL and the file path to read. It first verifies the target is a Mitel MiCollab instance, then checks for vulnerability, and finally sends a crafted POST request to the '/npm-pwg/..;/ReconcileWizard/reconcilewizard/sc/IDACall' endpoint with a specially crafted XML payload to retrieve the specified file. The README provides usage instructions and affected version details. The exploit is operational and provides direct file read capability if the target is vulnerable.