{"id":105422,"date":"2022-10-30T21:36:53","date_gmt":"2022-10-30T19:36:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos"},"modified":"2022-10-30T21:36:53","modified_gmt":"2022-10-30T19:36:53","slug":"uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos","title":{"rendered":"Vulnerabilities in the web interface of Juniper network devices shipped with JunOS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Several vulnerabilities have been identified in the J-Web web interface used in network devices from Juniper that run the JunOS operating system. The most critical of these (CVE-2022-22241) allows for remote code execution without authentication through the submission of a specially crafted HTTP request. Users of Juniper equipment are advised to install a firmware update. If this is not possible, they should ensure that access to the web interface is blocked from external networks and limited to trusted hosts. <\/p>\n
The essence of the vulnerability is that the file path provided by the user is processed in the script \/jsdm\/ajax\/logging_browse.php without filtering the prefix with the content type before authentication checks. An attacker can pass a malicious phar file disguised as an image and execute PHP code stored in the phar archive, using a \"Phar deserialization\" attack method (for example, by specifying in the request \"filepath=phar:\/path\/pharfile.jpg\"). <\/p>\n
The problem is that when checking the uploaded file using the PHP function is_dir(), this function automatically performs deserialization of metadata from a Phar archive when processing paths that start with \"phar:\/\/\". A similar effect is observed when processing user-provided file paths in functions such as file_get_contents(), fopen(), file(), file_exists(), md5_file(), filemtime(), and filesize(). <\/p>\n
The attack is complicated by the fact that, in addition to initiating the execution of the phar archive, the attacker must find a way to upload it to the device (accessing \/jsdm\/ajax\/logging_browse.php only allows specifying a path for executing an already existing file). Possible scenarios for uploading files to the device include uploading a phar file disguised as an image via an image transfer service and placing a file in the web content cache. <\/p>\n
Other vulnerabilities: <\/p>\n
\n
CVE-2022-22242 \u2014 injection of unfiltered external parameters into the output of the script error.php, allowing for cross-site scripting (XSS) and execution of arbitrary JavaScript code in the user's browser when following a link (for example, \"https:\/\/JUNOS_IP\/error.php?SERVER_NAME=\"). This vulnerability can be exploited to intercept administrator session parameters if the attacker manages to get the administrator to click on a specially crafted link.\n
CVE-2022-22243, CVE-2022-22244 \u2014 injection of XPATH expressions through the scripts jsdm\/ajax\/wizards\/setup\/setup.php and \/modules\/monitor\/interfaces\/interface.php, allowing an unauthenticated user to manipulate administrator sessions.\n
CVE-2022-22245 \u2014 lack of proper sanitization of the \"..\" sequence in paths processed in the script Upload.php, allowing an authenticated user to upload their PHP file to a directory that allows PHP script execution (for example, by passing the path \"fileName=\\..\\..\\..\\..\\www\\dir\\new\\shell.php\").\n
CVE-2022-22246 \u2014 the ability to execute arbitrary local PHP files through manipulation by an authenticated user with the script jrest.php, where external parameters are used to form the filename loaded by the function \"require_once()\" (for example, \"\/jrest.php?payload=alol\/lol\/any\\..\\..\\..\\..\\any\\file\"). <\/ul>\n