Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe analysis is based on a detailed reverse engineering article titled 'Reversing MikroTik's Silent Patch: The RouterOS 7.23.4 Fix They Wouldn’t Explain' by Nick Pratley. This article meticulously dissects the changes introduced in the patched RouterOS versions and identifies two distinct vulnerabilities:
Argument Injection via Crafted Username: The article explains that the /nova/bin/login executable, used by the SSH login path, had a legacy argument parsing mechanism. This mechanism would interpret a username starting with a hyphen (e.g., '-2') as a file descriptor. By crafting the username, an attacker could inject a full policy mask, leading to privilege escalation. The fix involved adding a validLoginParamInput function to validate usernames before they reached this vulnerable parser. The vulnerable component is the argument parsing logic within the login executable itself.
RSA Signature Forgery (Low-exponent RSA): This vulnerability involves two related flaws. First, the SSH daemon (sshd) had a lenient PKCS#1 v1.5 padding check, accepting a weak 00 01 00 prefix, which made it easier to forge signatures, especially with low RSA exponents. Second, the RsaPublicKey::parseHashFromDerEncoded function in libucrypto.so failed to properly validate the length of the extracted digest and did not ensure that no trailing bytes remained after the digest. These combined weaknesses allowed for the bypass of SSH public-key authentication. The article provides the mangled C++ symbol for the vulnerable function in libucrypto.so and describes the problematic padding check logic within the sshd binary.
The identified functions represent the specific code paths that were either directly vulnerable or lacked necessary security checks, as evidenced by the detailed technical analysis and the nature of the patches described in the reference article.
login (argument parsing logic)/nova/bin/login
sshd (PKCS#1 v1.5 padding check)/bndl/security/nova/bin/sshd
RsaPublicKey::parseHashFromDerEncoded/lib/libucrypto.so