6 ms·

RCE on MikroTik routers with IPv6 RA enabled

109 points by dgroshev 3y ago

ghostpepper 3y ago
Interesting that they say the combination of setting is uncommon but somehow I had it set on my RB5009 running 7.9.0 IMHO it's disturbing that any component of the IPv6 stack can be exploited even with /ipv6/settings/disable-ipv6 yes There also seems to be a disagreement between Mikrotik and the researchers about whether the vuln was actually disclosed in Dec. Hopefully some more info comes out regarding that.
- cookiengineer 3y ago
  You're in for a treat: Google for "icmpv6 vulnerability" ... There is just so many bad neighbor discovery related RCEs, it makes my heart bleed. Even tcpdump was too naively implemented at some point.
- crest 3y ago
  The report says it can be exploited with IPv6 enabled, but IPv6 forwarding disabled and reception of router advertisements conditional on the this aka stop looking at router advertisements if the system is configured as IPv6 router.
  - ghostpepper 3y ago
    Maybe the blog post is just ambiguously worded but I'd like a confirmation from them if so. You are only affected if one of the below settings is applied: ipv6/settings/ set accept-router-advertisements=yes or ipv6/settings/set forward=no accept-router-advertisements=yes-if-forwarding-disabled Specifically I'd like to know whether this config is vulnerable: /ipv6/settings/set disable-ipv6=yes forward=no accept-router-advertisements=yes-if-forwarding-disabled
    - bombcar 3y ago
      It is ambiguous but I'd hope that disable-ipv6 would override everything else. I had /ipv6/settings/print disable-ipv6: no forward: yes accept-redirects: yes-if-forwarding-disabled accept-router-advertisements: yes-if-forwarding-disabled max-neighbor-entries: 8192 which I interpreted as "maybe" being ok? But I upgraded anyway.
    - crest 3y ago
      Run `/ipv6/settings/export verbose` to show you the combination of your configuration and the default values on the relevant subtree. I would've expected the `disable-ipv6` to disable all ICMPv6 processing including the code paths leading to the RCE vulnerability, but the post doesn't state it explicitly.
- dboreham 3y ago
  > disagreement between Mikrotik and the researchers about whether the vuln was actually disclosed in Dec It seems likely that it was not properly disclosed because according to https://mikrotik.com/supportsec https://mikrotik.com/supportsec "you will be notified within 48 hours with acknowledgement of the issue" , but the reporter's web site states "ZDI reported the vulnerability to the vendor during Pwn2Own Toronto". According to MT, none of their staff attended that event. https://www.zerodayinitiative.com/advisories/ZDI-23-710/ https://www.zerodayinitiative.com/advisories/ZDI-23-710/
- mannyv 3y ago
  I would like to assume disabling ipv6 turns off all the related daemons, but it's not explicitly stated anywhere.
scrumlord 3y ago
[dead]
mastax 3y ago
On a tangentially related note I recently found another manufacturer that is very similar to MikroTik: Teltonika. They are also based in a baltic state (Lithuania) and manufacture a range of inexpensive mostly-commercial-focused networking products. Their firmware is pretty open, and they provide a pretty good SDK that can build all the open source bits of the firmware and can be used to develop third party applications for their routers. I'm evaluating their RUTX11 LTE/WiFi router as an in-vehicle router for a commercial application. I'm reasonably impressed so far. Their firmware strategy seems to be going for implementing every feature under the sun, so I'd be a bit concerned about the robustness of some of the edge cases, but no problems yet. (This is not intended to imply "move off of MikroTik to Teltonika because of this security issue" at all, I just needed to get this out of my system)
- cookiengineer 3y ago
  Losely related: I can recommend the Linksys WRT series. These are all OpenWRT compatible and can easily be reflashed. They're also BPF/XDP compatible, though they obviously have no netronome smartNICs in there. Also, golang can easily cross-compile to them, and the static binaries work without issues in case you want to do more with it :)
- iso1631 3y ago
  I used their rut to provide 2 paths out for comms to 10 locations around the UK for a high profile Outside Broadcast a couple of weeks ago. The RUTs have decent modems and took two sim cards, and could be configured with routing policies to effectively have two independent paths out. Used a mikrotik for the third off some venue network which varied depending on the location. I set up a wireguard tunnel from the RUT so I could have remote management to the rut and to the tieline gateway providing the comms over one of the sims, in addition to my normal tunnel from the mikrotik. In Dover sim coverage was patchy, as was the "ethernet line" (which I believe was a 60G wireless link across the harbour). Just before the broadcast started the "ethernet" circuit dropped off, as did one of the sims. The other sim had fortunatly managed to connect to a French 4G provider. Another location had issues with the venue internet so again rut to the rescue, but another location had no 4g coverage at all so wired did the job. Those ruts are now on the way to be in use at a site near Poole to do 3 sim cards worth of connectivity to some remote locations. I really like the wireguard connection, makes it easy to see what's going, and they're a nice little box anyway. Configuration isn't good though -- a mikrotik has a nice simple "/export terse" to see how it's configured and easilly apply. The Ruts config is spread all over the file system and it's not obvious to me yet how to manage that. There's some bugs in the gui too around routing tables too.
kardianos 3y ago
If you are on 7.x stable, on May 19th they released a new point version 7.9.1 to fix this.
- OJFord 3y ago
  Curiously after upgrading there's a separate 'upgrade firmware' to be done (no idea if necessary for this though) in System > RouterBOARD. Mine was still on its stock 6.something though I was on 7.7 software. Just found it by accident looking for where to upgrade to 7.9.1. (Even more curiously, I seem to get a duplicate menu item every time I reboot - three of each now (6.something / 7.7 -> 7.7 / 7.91 -> 7.9.1 reboots) ..almost in order - some of them seem to be somehow grouped for ordering purposes (and so are repeated as a group, not individually) despite not being nested or even obviously related.)
  - nubinetwork 3y ago
    It's always been like this, I wish they would just do both at the same time since you have to reboot anyways.
  - justsomehnguy 3y ago
    > Curiously after upgrading there's a separate 'upgrade firmware' to be done (no idea if necessary for this though) >> The version of the RouterBOOT loader is currently in use. Not to be confused with RouterOS operating system version. https://help.mikrotik.com/docs/display/ROS/RouterBOARD https://help.mikrotik.com/docs/display/ROS/RouterBOARD https://help.mikrotik.com/docs/display/ROS/RouterBOOT https://help.mikrotik.com/docs/display/ROS/RouterBOOT
hamandcheese 3y ago
I was interested in Mikrotik devices, but then I looked at the API documentation[1] and was a bit horrified. [1]: https://help.mikrotik.com/docs/display/ROS/API https://help.mikrotik.com/docs/display/ROS/API
- dboreham 3y ago
  Hmm. I've been using MT routers for 15 years and never knew there was an API. Presumably you want to use them in some SDN scenario?
  - hamandcheese 3y ago
    I don't care about SDN per se, but I do desire a home network that I can configure and deploy (or easily re-bootstrap) from a git repo with a plain text editor. The result is that I use NixOS for my NAT gateway/firewall, and simply live without fancier network features (I only have two NICs in that machine). For wifi I begrudgingly use an off-the-shelf wifi router combo in bridge mode.
  - crest 3y ago
    It's easier and cleaner to automate than sending SSH commands.
- proactivesvcs 3y ago
  I set one up for the first time a few weeks back. The Web UI would sometimes time out my session after less than a minute, and then many of the sidebar buttons would be duplicated. Choosing a "template" option for how the WiFi/LTE is used would appear to take effect, but be ignored. There was no option to enter a password for the 5GHz radio, it simply remained open. It stopped responding and had to be factory reset. This was all over a stable wired Ethernet with a browser config that allows scripts, cookies etc, and before any work I'd upgraded its firmware and performed a factory reset. I too was a bit horrified.
  - iso1631 3y ago
    Been using them since the 00s, never had that experience, I've got 190 permament installs globally and another 50 or so which come and go as the need arises.
drdaeman 3y ago
I cannot find the details of this CVE, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32154 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3215... just says "reserved". Is this normal? What I'm concerned about is if this is a Mikrotik-specific issue or - given that IIRC their RouterOS is essentially a specialized and highly customized GNU/Linux distribution (I could be wrong) - some issue in Linux kernel or radvd. Aka "should I worry about my own software routers, or if this is strictly about Mikrotik?"
- toast0 3y ago
  It's not unusual for the CVE to be listed as reserved when other content comes out referencing the number. The process is basically ask mitre for a CVE number, then discuss the vulnerability with multiple parties using that number, and at some point someone puts details into the mitre database. Usually the CVE is updated before a public mention by the vendor, but not always.
- fest 3y ago
  > given that IIRC their RouterOS is essentially a specialized and highly customized GNU/Linux distribution (I could be wrong) Based on my conversations with people who have worked there- RouterOS is running on Linux kernel, but it's so heavily patched, that upgrades to newer version are.. delayed until the benefits of the upgrade exceeds the cost. Up until the release of RouterOS 7 (circa 2021-2022) it was running on Linux kernel 3.3 (of 2012 vintage). The drawbacks to this may not be obvious at first, but e.g. Wireguard support took a few years.
  - cycomanic 3y ago
    Shouldnt we be able to know this? If it is a Linux kernel there should be a download source somewhere, or are you saying mikrotik is violating the GPL?
    - greyface- 3y ago
      Allegedly, you can get the sources on CD-ROM if you wire them $45: https://mikrotik.com/downloadterms.html https://mikrotik.com/downloadterms.html
bombcar 3y ago
Apropos of not much, many Mikrotik devices can run OpenWRT, if that's your thing.
wepple 3y ago
Possibly this: https://github.com/radvd-project/radvd/commit/f67335b5335b6ed5ca68d6fa71c08cccb4f3a629 https://github.com/radvd-project/radvd/commit/f67335b5335b6e...
Habgdnv 3y ago
This vulnerability doesn't impact routers with default settings (according to the post). The vulnerability only arises when a router is specifically configured to function as an endpoint device in IPv6, rather than its default setting as a router. If you set your default GW statically or using some routing protocol, you're fine. And PS: One of my routers that I just checked is running 7.9beta4, and the next available version (testing) is 7.10beta5. In the blog post they said that the fix is in 7.10beta7
- ThePowerOfFuet 3y ago
  This reddit post seems to claim otherwise: https://www.reddit.com/r/mikrotik/comments/13oloi3/comment/jl7a7i8 https://www.reddit.com/r/mikrotik/comments/13oloi3/comment/j...
Cosmopolitican 3y ago
Perhaps there's a security shortcoming in the hardware architecture upon which we build firmware/software for routers and such appliances? Is this not a legitimate inquiry? Just curious why this leads to being quickly downvoted.
m463 3y ago
I love mikrotik hardware and run openwrt on it. However, I turn off ipv6 in my internal network. fyi I mainly use rb3011 routers and this branch: https://github.com/adron-s/openwrt-rb3011 https://github.com/adron-s/openwrt-rb3011 EDIT: yes, I understand this is only tangentially related to the routeros ipv6 ra cve
RantyDave 3y ago
Vendor was informed in person at an event in Toronto, where MikroTik was not present in any capacity. Except for a black hat with a MikroTik name badge and handing out merch. Cunning, no?

109 points by dgroshev 3y ago

Interesting that they say the combination of setting is uncommon but somehow I had it set on my RB5009 running 7.9.0 IMHO it's disturbing that any component of the IPv6 stack can be exploited even with /ipv6/settings/disable-ipv6 yes There also seems to be a disagreement between Mikrotik and the researchers about whether the vuln was actually disclosed in Dec. Hopefully some more info comes out regarding that.

cookiengineer 3y ago
You're in for a treat: Google for "icmpv6 vulnerability" ... There is just so many bad neighbor discovery related RCEs, it makes my heart bleed. Even tcpdump was too naively implemented at some point.
crest 3y ago
The report says it can be exploited with IPv6 enabled, but IPv6 forwarding disabled and reception of router advertisements conditional on the this aka stop looking at router advertisements if the system is configured as IPv6 router.
- ghostpepper 3y ago
  Maybe the blog post is just ambiguously worded but I'd like a confirmation from them if so. You are only affected if one of the below settings is applied: ipv6/settings/ set accept-router-advertisements=yes or ipv6/settings/set forward=no accept-router-advertisements=yes-if-forwarding-disabled Specifically I'd like to know whether this config is vulnerable: /ipv6/settings/set disable-ipv6=yes forward=no accept-router-advertisements=yes-if-forwarding-disabled
  - bombcar 3y ago
    It is ambiguous but I'd hope that disable-ipv6 would override everything else. I had /ipv6/settings/print disable-ipv6: no forward: yes accept-redirects: yes-if-forwarding-disabled accept-router-advertisements: yes-if-forwarding-disabled max-neighbor-entries: 8192 which I interpreted as "maybe" being ok? But I upgraded anyway.
  - crest 3y ago
    Run `/ipv6/settings/export verbose` to show you the combination of your configuration and the default values on the relevant subtree. I would've expected the `disable-ipv6` to disable all ICMPv6 processing including the code paths leading to the RCE vulnerability, but the post doesn't state it explicitly.
dboreham 3y ago
> disagreement between Mikrotik and the researchers about whether the vuln was actually disclosed in Dec It seems likely that it was not properly disclosed because according to https://mikrotik.com/supportsec https://mikrotik.com/supportsec "you will be notified within 48 hours with acknowledgement of the issue" , but the reporter's web site states "ZDI reported the vulnerability to the vendor during Pwn2Own Toronto". According to MT, none of their staff attended that event. https://www.zerodayinitiative.com/advisories/ZDI-23-710/ https://www.zerodayinitiative.com/advisories/ZDI-23-710/
mannyv 3y ago
I would like to assume disabling ipv6 turns off all the related daemons, but it's not explicitly stated anywhere.

scrumlord 3y ago

[dead]

mastax 3y ago

On a tangentially related note I recently found another manufacturer that is very similar to MikroTik: Teltonika. They are also based in a baltic state (Lithuania) and manufacture a range of inexpensive mostly-commercial-focused networking products. Their firmware is pretty open, and they provide a pretty good SDK that can build all the open source bits of the firmware and can be used to develop third party applications for their routers. I'm evaluating their RUTX11 LTE/WiFi router as an in-vehicle router for a commercial application. I'm reasonably impressed so far. Their firmware strategy seems to be going for implementing every feature under the sun, so I'd be a bit concerned about the robustness of some of the edge cases, but no problems yet. (This is not intended to imply "move off of MikroTik to Teltonika because of this security issue" at all, I just needed to get this out of my system)

cookiengineer 3y ago
Losely related: I can recommend the Linksys WRT series. These are all OpenWRT compatible and can easily be reflashed. They're also BPF/XDP compatible, though they obviously have no netronome smartNICs in there. Also, golang can easily cross-compile to them, and the static binaries work without issues in case you want to do more with it :)
iso1631 3y ago
I used their rut to provide 2 paths out for comms to 10 locations around the UK for a high profile Outside Broadcast a couple of weeks ago. The RUTs have decent modems and took two sim cards, and could be configured with routing policies to effectively have two independent paths out. Used a mikrotik for the third off some venue network which varied depending on the location. I set up a wireguard tunnel from the RUT so I could have remote management to the rut and to the tieline gateway providing the comms over one of the sims, in addition to my normal tunnel from the mikrotik. In Dover sim coverage was patchy, as was the "ethernet line" (which I believe was a 60G wireless link across the harbour). Just before the broadcast started the "ethernet" circuit dropped off, as did one of the sims. The other sim had fortunatly managed to connect to a French 4G provider. Another location had issues with the venue internet so again rut to the rescue, but another location had no 4g coverage at all so wired did the job. Those ruts are now on the way to be in use at a site near Poole to do 3 sim cards worth of connectivity to some remote locations. I really like the wireguard connection, makes it easy to see what's going, and they're a nice little box anyway. Configuration isn't good though -- a mikrotik has a nice simple "/export terse" to see how it's configured and easilly apply. The Ruts config is spread all over the file system and it's not obvious to me yet how to manage that. There's some bugs in the gui too around routing tables too.

kardianos 3y ago

If you are on 7.x stable, on May 19th they released a new point version 7.9.1 to fix this.

OJFord 3y ago
Curiously after upgrading there's a separate 'upgrade firmware' to be done (no idea if necessary for this though) in System > RouterBOARD. Mine was still on its stock 6.something though I was on 7.7 software. Just found it by accident looking for where to upgrade to 7.9.1. (Even more curiously, I seem to get a duplicate menu item every time I reboot - three of each now (6.something / 7.7 -> 7.7 / 7.91 -> 7.9.1 reboots) ..almost in order - some of them seem to be somehow grouped for ordering purposes (and so are repeated as a group, not individually) despite not being nested or even obviously related.)
- nubinetwork 3y ago
  It's always been like this, I wish they would just do both at the same time since you have to reboot anyways.
- justsomehnguy 3y ago
  > Curiously after upgrading there's a separate 'upgrade firmware' to be done (no idea if necessary for this though) >> The version of the RouterBOOT loader is currently in use. Not to be confused with RouterOS operating system version. https://help.mikrotik.com/docs/display/ROS/RouterBOARD https://help.mikrotik.com/docs/display/ROS/RouterBOARD https://help.mikrotik.com/docs/display/ROS/RouterBOOT https://help.mikrotik.com/docs/display/ROS/RouterBOOT

hamandcheese 3y ago

I was interested in Mikrotik devices, but then I looked at the API documentation[1] and was a bit horrified. [1]: https://help.mikrotik.com/docs/display/ROS/API https://help.mikrotik.com/docs/display/ROS/API

dboreham 3y ago
Hmm. I've been using MT routers for 15 years and never knew there was an API. Presumably you want to use them in some SDN scenario?
- hamandcheese 3y ago
  I don't care about SDN per se, but I do desire a home network that I can configure and deploy (or easily re-bootstrap) from a git repo with a plain text editor. The result is that I use NixOS for my NAT gateway/firewall, and simply live without fancier network features (I only have two NICs in that machine). For wifi I begrudgingly use an off-the-shelf wifi router combo in bridge mode.
- crest 3y ago
  It's easier and cleaner to automate than sending SSH commands.
proactivesvcs 3y ago
I set one up for the first time a few weeks back. The Web UI would sometimes time out my session after less than a minute, and then many of the sidebar buttons would be duplicated. Choosing a "template" option for how the WiFi/LTE is used would appear to take effect, but be ignored. There was no option to enter a password for the 5GHz radio, it simply remained open. It stopped responding and had to be factory reset. This was all over a stable wired Ethernet with a browser config that allows scripts, cookies etc, and before any work I'd upgraded its firmware and performed a factory reset. I too was a bit horrified.
- iso1631 3y ago
  Been using them since the 00s, never had that experience, I've got 190 permament installs globally and another 50 or so which come and go as the need arises.

drdaeman 3y ago

I cannot find the details of this CVE, https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-32154 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3215... just says "reserved". Is this normal? What I'm concerned about is if this is a Mikrotik-specific issue or - given that IIRC their RouterOS is essentially a specialized and highly customized GNU/Linux distribution (I could be wrong) - some issue in Linux kernel or radvd. Aka "should I worry about my own software routers, or if this is strictly about Mikrotik?"

toast0 3y ago
It's not unusual for the CVE to be listed as reserved when other content comes out referencing the number. The process is basically ask mitre for a CVE number, then discuss the vulnerability with multiple parties using that number, and at some point someone puts details into the mitre database. Usually the CVE is updated before a public mention by the vendor, but not always.
fest 3y ago
> given that IIRC their RouterOS is essentially a specialized and highly customized GNU/Linux distribution (I could be wrong) Based on my conversations with people who have worked there- RouterOS is running on Linux kernel, but it's so heavily patched, that upgrades to newer version are.. delayed until the benefits of the upgrade exceeds the cost. Up until the release of RouterOS 7 (circa 2021-2022) it was running on Linux kernel 3.3 (of 2012 vintage). The drawbacks to this may not be obvious at first, but e.g. Wireguard support took a few years.
- cycomanic 3y ago
  Shouldnt we be able to know this? If it is a Linux kernel there should be a download source somewhere, or are you saying mikrotik is violating the GPL?
  - greyface- 3y ago
    Allegedly, you can get the sources on CD-ROM if you wire them $45: https://mikrotik.com/downloadterms.html https://mikrotik.com/downloadterms.html

bombcar 3y ago

Apropos of not much, many Mikrotik devices can run OpenWRT, if that's your thing.

wepple 3y ago

Possibly this: https://github.com/radvd-project/radvd/commit/f67335b5335b6ed5ca68d6fa71c08cccb4f3a629 https://github.com/radvd-project/radvd/commit/f67335b5335b6e...

Habgdnv 3y ago

This vulnerability doesn't impact routers with default settings (according to the post). The vulnerability only arises when a router is specifically configured to function as an endpoint device in IPv6, rather than its default setting as a router. If you set your default GW statically or using some routing protocol, you're fine. And PS: One of my routers that I just checked is running 7.9beta4, and the next available version (testing) is 7.10beta5. In the blog post they said that the fix is in 7.10beta7

ThePowerOfFuet 3y ago
This reddit post seems to claim otherwise: https://www.reddit.com/r/mikrotik/comments/13oloi3/comment/jl7a7i8 https://www.reddit.com/r/mikrotik/comments/13oloi3/comment/j...

Cosmopolitican 3y ago

Perhaps there's a security shortcoming in the hardware architecture upon which we build firmware/software for routers and such appliances? Is this not a legitimate inquiry? Just curious why this leads to being quickly downvoted.

m463 3y ago

I love mikrotik hardware and run openwrt on it. However, I turn off ipv6 in my internal network. fyi I mainly use rb3011 routers and this branch: https://github.com/adron-s/openwrt-rb3011 https://github.com/adron-s/openwrt-rb3011 EDIT: yes, I understand this is only tangentially related to the routeros ipv6 ra cve

RantyDave 3y ago

Vendor was informed in person at an event in Toronto, where MikroTik was not present in any capacity. Except for a black hat with a MikroTik name badge and handing out merch. Cunning, no?