MikroTik Router Vulnerabilities Can Lead to Backdoor Creation

guest · Oct 29, 2019

MikroTik Router Vulnerabilities Can Lead to Backdoor Creation
October 29, 2019
https://www.securityweek.com/mikrotik-router-vulnerabilities-can-lead-backdoor-creation

A chain of vulnerabilities in MikroTik routers could allow an attacker to gain a backdoor. The chain starts with DNS poisoning, goes on to downgrading the installed version of MikroTik's RouterOS software, and ends with enabling a backdoor.

Tenable found the vulnerabilities and disclosed two to MikroTik on September 11, 2019 (CVE-2019-3976 and CVE-2019-3977) and two more on September 13, 2019 (CVE-2019-3978 and CVE-2019-3979). It said, "By chaining these vulnerabilities, an unauthenticated remote attacker with access to port 8291 on the router, can perform a RouterOS downgrade, reset the system passwords, and potentially gain a root shell." MikroTik released patches on October 28, 2019.

"Since we can specify the DNS server the request should go through, it's trivial to inject bad addresses," writes a Tenable researcher in a blog post describing the vulnerabilities.
V6.41.4 was chosen by the researcher because it has known vulnerabilities "that enable a backdoor on the system. Using those vulnerabilities I can get a full busybox shell," said the researcher.
Click to expand...

These vulnerabilities were fixed by MikroTik in new version 6.45.7, released on September 10, 2019 (well within the 90-days responsible disclosure period set by Tenable).
Click to expand...

RouterOS: Chain to Root

The path to code execution isn’t always a straight line.
This blog guides the reader down that path, beginning with unauthenticated requests to Winbox and ending with a root busybox shell.
Click to expand...

guest · Dec 16, 2019

Most MikroTik routers fail to get patched a month after severe security issues disclosed
December 16, 2019
https://portswigger.net/daily-swig/...-month-after-severe-security-issues-disclosed

The majority of consumer and enterprise routers produced by MikroTik are at risk of device hijacking and remote DNS cache poisoning, a security researcher has warned.
This is despite the release of a batch of security updates last month for the issues impacting MikroTik RouterOS 6.45.6 and below.

In a blog post published late last week (December 12), Baines said he performed a search on Shodan to examine the progress made by administrators to patch vulnerable routers.
While a preliminary search on Shodan only revealed 10 vulnerable devices, the researcher wrote his own scanner to find 578,456 MikroTik routers with port 8291 open – MikroTik recommends that this port is kept closed.

By searching through this port alone, Baines was able to extract OS data from the available routers, finding that only 15% have been upgraded over a month after the patch release.
Click to expand...

Speaking to The Daily Swig, Baines said that ten months after the discovery of a previous vulnerability by Tenable, CVE-2019-3924, less than 50% of routers have been upgraded. He estimates it will take a year before reaching “50 - 60% [of] patch application against our latest set of vulnerabilities.”

“On the other hand, it’s hard to say exactly what the overall patch application for all MikroTik routers is,” the researcher added.
“Apart from knocking on doors and helping people do the upgrade, there is not much else we could have done,” the company said.
Click to expand...

Winbox in the Wild - Port 8291 Scan Results

Log in or Sign up

MikroTik Router Vulnerabilities Can Lead to Backdoor Creation

guest Guest

guest Guest

Log in or Sign up

MikroTik Router Vulnerabilities Can Lead to Backdoor Creation

guest Guest

guest Guest

Useful Searches