New Exploit for MikroTik Router WinBox Vulnerability Gives Full Root Access

A cybersecurity researcher from Tenable Research has released a
new proof-of-concept (PoC) RCE attack for an old directory
traversal vulnerability that was found and patched within a day of
its discovery in April this year.

The vulnerability, identified as CVE-2018-14847, was initially
rated as medium in severity but should now be rated critical
because the new hacking technique used against vulnerable MikroTik
routers allows attackers to remotely execute code on affected
devices and gain a root shell.

The vulnerability impacts Winbox—a management component for
administrators to set up their routers using a Web-based
interface—and a Windows GUI application for the RouterOS software
used by the MikroTik devices.

The vulnerability allows “remote attackers to bypass
authentication and read arbitrary files by modifying a request to
change one byte related to a Session ID.”

New Hack Turned ‘Medium’ MikroTik Vulnerability Into
‘Critical’

However, the new attack method found by Tenable Research exploits
the same vulnerability and takes it to one step ahead.

A PoC exploit, called “By the Way^[1],” released by Tenable
Research Jacob Baines, first uses directory traversal vulnerability
to steal administrator login credentials from user database file
and the then writes another file on the system to gain root shell
access remotely.

In other words, the new exploit could allow unauthorized
attackers to hack MikroTik’s RouterOS system, deploy malware
payloads or bypass router firewall protections.

The technique is yet another security blow against MikroTik
routers^[2], which was previously
targeted by the VPNFilter
malware^[3] and used in an extensive
cryptojacking
campaign^[4] uncovered a few months
ago.

New MikroTik Router Vulnerabilities

Besides this, Tenable Research also disclosed additional MikroTik RouterOS
vulnerabilities, including:

• CVE-2018-1156—A stack buffer overflow flaw that could allow an
  authenticated remote code execution, allowing attackers to gain
  full system access and access to any internal system that uses the
  router.
• CVE-2018-1157—A file upload memory exhaustion flaw that allows
  an authenticated remote attacker to crash the HTTP server.
• CVE-2018-1159—A www memory corruption flaw that could crash the
  HTTP server by rapidly authenticating and disconnecting.
• CVE-2018-1158—A recursive parsing stack exhaustion issue that
  could crash the HTTP server via recursive parsing of JSON.

The vulnerabilities impact Mikrotik RouterOS firmware versions
before 6.42.7 and 6.40.9.

Tenable Research reported the issues to MikroTik in May, and the
company addressed the vulnerabilities by releasing its RouterOS
versions 6.40.9, 6.42.7 and 6.43 in August.

While all the vulnerabilities were patched over a month ago, a
recent scan by Tenable Research revealed that 70 percent of routers
(which equals to 200,000) are still vulnerable to attack.

The bottom line: If you own a MikroTik router and you have not
updated its RouterOS, you should do it right now.

Also, if you are still using default credentials on your router,
it is high time to change the default password and keep a unique,
long and complex password.

^[5]