The Verizon MiFi 6620L, version 4.5, allows an unauthenticated threat actor to upload an arbitrary file to any location on the device through the web interface. While a CSRF token is present, it is not validated by the server when uploading the file.
An unauthenticated threat actor can send a multipart/form-data POST request to http://my.jetpack/ with an arbitrary file in the body. By default the file is saved to the '/tmp' directory. However, the 'filename' parameter is not correctly sanitized, allowing a user to save the file to any location by prepending '../' to the file location. The web interface runs as the 'lighttpd' user; sensitive files owned by that user, including '/sysconf/ui_config.xml', can be modified through this upload.
A victim can be tricked into clicking a malicious link that uses JavaScript to upload a modified 'ui_config.xml', altering device settings such as the web interface password, removing web authentication, and modifying the QML source used by the device UI.
Chained with the 'Escalated Privileges through Backup Restore Function' issue, a full device compromise is possible: the victim clicks a malicious link, JavaScript uploads a modified WiFi.qml and ui_config.xml that disable authentication on reboot, the device reboots, and a subsequent menu interaction triggers a malicious QML that retrieves a valid CSRF token and uploads a backup configuration containing a root crontab and busybox, creating a reverse shell back to the attacker with root access.
A proof-of-concept video is available here.
The Verizon MiFi 6620L, version 4.5, lets an unauthenticated threat actor upload an arbitrary file to any location on the device through the web interface. A CSRF token is present but the server does not validate it when the file is uploaded. Advisory L9-46-493 rates the impact High.
No. The advisory describes an unauthenticated threat actor sending the upload request to the device web interface. The CSRF token that would normally block a cross site request is present in the interface but is not validated by the server on upload. The advisory lists the category as remote file inclusion.
On the Verizon MiFi 6620L the uploaded file is saved to the /tmp directory by default. The advisory states the filename parameter is not correctly sanitized, so prepending ../ writes the file to any location. The web interface runs as the lighttpd user, and files owned by that user, including /sysconf/ui_config.xml, can be modified this way.
The MiFi upload is delivered by tricking a victim into clicking a malicious link, where JavaScript sends a multipart form data POST to the device web interface. The advisory describes uploading a modified ui_config.xml that changes device settings, including the web interface password, removing web authentication and altering the QML source used by the device user interface.
Yes. The advisory describes a full device compromise: the victim clicks a malicious link, JavaScript uploads a modified WiFi.qml and ui_config.xml that disable authentication on reboot, the device reboots, and a later menu interaction triggers QML that retrieves a valid CSRF token and restores a backup containing a root crontab and busybox. The result is a reverse shell with root access.