The Verizon MiFi 6620L, version 4.5, allows an unauthenticated threat actor to upload an arbitrary file to any location on the device through the web interface. While a CSRF token is present, it is not validated by the server when uploading the file.
An unauthenticated threat actor can send a multipart/form-data POST request to http://my.jetpack/ with an arbitrary file in the body. By default the file is saved to the '/tmp' directory. However, the 'filename' parameter is not correctly sanitized, allowing a user to save the file to any location by prepending '../' to the file location. The web interface runs as the 'lighttpd' user; sensitive files owned by that user, including '/sysconf/ui_config.xml', can be modified through this upload.
A victim can be tricked into clicking a malicious link that uses JavaScript to upload a modified 'ui_config.xml', altering device settings such as the web interface password, removing web authentication, and modifying the QML source used by the device UI.
Chained with the 'Escalated Privileges through Backup Restore Function' issue, a full device compromise is possible: the victim clicks a malicious link, JavaScript uploads a modified WiFi.qml and ui_config.xml that disable authentication on reboot, the device reboots, and a subsequent menu interaction triggers a malicious QML that retrieves a valid CSRF token and uploads a backup configuration containing a root crontab and busybox, creating a reverse shell back to the attacker with root access.
A proof-of-concept video is available here.