MikroTik RouterOS up to 6.40.8/6.42.6 HTTP Server JSON resource consumption

Summaryinfo

A vulnerability, which was classified as problematic, was found in MikroTik RouterOS up to 6.40.8/6.42.6. This issue affects some unknown processing of the component HTTP Server. Executing a manipulation as part of JSON can lead to resource consumption. This vulnerability is registered as CVE-2018-1158. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in MikroTik RouterOS up to 6.40.8/6.42.6 (Router Operating System) and classified as problematic. This vulnerability affects some unknown functionality of the component HTTP Server. The manipulation as part of a JSON leads to a resource consumption vulnerability. The CWE definition for the vulnerability is CWE-400. The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources. As an impact it is known to affect availability. CVE summarizes:

Mikrotik RouterOS before 6.42.7 and 6.40.9 is vulnerable to a stack exhaustion vulnerability. An authenticated remote attacker can crash the HTTP server via recursive parsing of JSON.

The bug was discovered 08/22/2018. The weakness was published 08/23/2018 (Website). The advisory is shared for download at mikrotik.com. This vulnerability was named CVE-2018-1158 since 12/04/2017. The exploitation appears to be easy. The attack can be initiated remotely. A single authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1499.

The vulnerability scanner Nessus provides a plugin with the ID 112114 (MikroTik RouterOS < 6.40.9 / 6.42.7 / 6.43 multiple vulnerabilities.), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Misc. and running in the context r. The commercial vulnerability scanner Qualys is able to test this issue with plugin 13255 (MikroTik RouterOS Multiple Vulnerabilities).

Upgrading to version 6.40.9 or 6.42.7 eliminates this vulnerability. A possible mitigation has been published before and not just after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (112114). Similar entries are available at VDB-123158, VDB-123159 and VDB-123161. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Router Operating System

Vendor

• MikroTik

Name

• RouterOS

Version

• 6.40.0
• 6.40.1
• 6.40.2
• 6.40.3
• 6.40.4
• 6.40.5
• 6.40.6
• 6.40.7
• 6.40.8
• 6.42.0
• 6.42.1
• 6.42.2
• 6.42.3
• 6.42.4
• 6.42.5
• 6.42.6

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion