API bug - commas not escaped.

RouterOS Scripting
1

When using the API to read values, any commas encoded within values (e.g. in the comments field) are not escaped. This makes it practically impossible to parse returned output and could lead to denial of service or injection type attacks.

For example… Put a couple of commas inside a comment:

[admin@HotSpot] > /tool user-manager user set bill comment="This is a comment with a comma, there and then a possible injection type attack here,disabled=true"

and then use the API to get the result:

<<< /tool/user-manager/user/get
<<< =.id=bill
<<<
>>> !done
>>> =ret=.id=*13,subscriber=admin,name=bill,username=bill,password=123,group-name=newgroup,last-seen=never,credit-count=1,credit-left=01:00:00,credit-duration=01:00:00,credit-price=500,credit-time-added=01:00:00,comment=This is a comment with a comma, there and then a possible injection type attack here,disabled=true,disabled=false

In the example above, the comment field has two commas in it and the entire reply has two ‘disabled=’ values.

How do I go about reporting this as a bug?

2

send this explanation and link to this post to support@mikrotik.com to log a ticket.

3

i tested this and cannot reproduce the problem described
please check your api implementation or terminal settings as i cannot
reproduce problem you describe.

here is output i get using python implementation

<<< /ip/address/get
<<< =.id=*8
<<<

!done
ret=.id=*8,address=192.168.1.1/24,network=192.168.1.0,netmask=255.255.255.0,broadcast=192.168.1.255,interface=ether1,actual-interface=bridge1,comment=this is comment =with “space,.<>…”,disabled=false



address is added executing this command:

/ip/address/add
=address=192.168.1.1/24
=interface=ether1
=comment=this is comment =with “space,.<>…”

4

try without quotes …

5

quotes are there and not escaped, that is, if you did not notice. same as <> dots and commas, also if you did not notice, same as spaces that are not escaped.

so, if you are trying something on your custom programmed API implementation and that does not work - try that on Python API implementation from wiki

comment is

this is comment =with “space,.<>…”

6

i would like to suggest do not use get to get all the properties if entry

instead use print that will always return parsable output

7

the result

<<< /ip/address/get
<<< =.id=*A
<<<

!done
=ret=.id=*a,address=192.168.1.1/24,network=192.168.1.0,netmask=255.255.255.0,broadcast=192.168.1.255,interface=ether1,actual-interface=bridge1,comment=,disabled=false

>

That is precisely my point - how can the string "=ret=.id=*a,address=192.168.1.1/24,network=192.168.1.0,netmask=255.255.255.0,broadcast=192.168.1.255,interface=ether1,actual-interface=bridge1,comment=,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,disabled=false" be parsed?

As the commas are not escaped, it is impossible to parse the output.

Using 'getall' from the API is not a solution - for a database with a thousand users in it, it takes several seconds to find and parse the user from the entire list.

If 'get' from the API produced output in the same way that 'getall' does, this wouldn't be a problem as then the settings would be one per line and therefore easily parseable, but having it all in one long string as above simply doesn't work.

Nick.
8

there is also a print command that can be safely used

get works like this:

command:

/ip/address/get
=.id=*A
=value-name=address

output:

!done
=ret=192.168.1.1/24

that way, you get only one vaule

i think the safest/optimal at the moment is to use print with from tag

command

/ip/address/print
=from=*A

result:

!re
=.id=*A
=comment=,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
=address=192.168.1.1/24
=network=192.168.1.0
=broadcast=192.168.1.255
=interface=ether1
!done