A J-Web web interface, used in network devices from Juniper equipped with the JunOS operating system, has several vulnerabilities, the most dangerous of which (CVE-2022-22241) allows remote code execution without authentication by sending specially crafted HTTP requests. Users of Juniper equipment are advised to update their firmware, and if this is not possible, to ensure that access to the web interface is blocked from external networks and limited to trusted hosts.
The essence of the vulnerability is that the file path provided by the user is processed in the script /jsdm/ajax/logging_browse.php without filtering the prefix with the content type before authentication checks. An attacker can pass a malicious phar file disguised as an image and achieve the execution of PHP code placed inside the phar archive by using a 'Phar deserialization' attack method (for example, specifying in the request 'filepath=phar:/path/pharfile.jpg').
The problem is that when checking the uploaded file using the PHP function is_dir(), this function automatically deserializes metadata from the Phar archive when processing paths starting with 'phar://'. A similar effect is observed when processing user-provided file paths in functions like file_get_contents(), fopen(), file(), file_exists(), md5_file(), filemtime(), and filesize().
The attack is complicated by the fact that, in addition to initiating the execution of the phar archive, the attacker must find a way to upload it to the device (accessing /jsdm/ajax/logging_browse.php only allows specifying a path for executing an already existing file). Among the possible scenarios for getting files onto the device, the uploading of a phar file disguised as an image through an image transfer service and injecting a file into the web content cache are mentioned.
Egyéb sebezhetőségek:
- CVE-2022-22242 — the injection of unfiltered external parameters into the output of the error.php script, allowing for cross-site scripting and the execution of arbitrary JavaScript code in the user's browser when clicking on a link (for example, 'https://JUNOS_IP/error.php?SERVER_NAME='). This vulnerability can be exploited to capture the parameters of the administrator's session if the attacker succeeds in getting the administrator to open a specially crafted link.
- CVE-2022-22243, CVE-2022-22244 — XPATH kifejezések behelyettesítése jsdm/ajax/wizards/setup/setup.php és /modules/monitor/interfaces/interface.php szkriptek révén lehetővé teszi, hogy egy nem privilegizált hitelesített felhasználó manipulálja a rendszergazda munkameneteit.
- CVE-2022-22245 — a '..' szekvencia megfelelő tisztításának hiánya az Upload.php szkriptnél lehetővé teszi egy hitelesített felhasználó számára, hogy PHP fájlokat töltsön fel egy olyan könyvtárba, amely lehetővé teszi a PHP szkriptek végrehajtását (például a 'fileName=\..\..\..\..\www\dir\new\shell.php' útvonal átadásával).
- CVE-2022-22246 — a PHP fájlok tetszőleges helyi végrehajtásának lehetősége egy hitelesített felhasználó manipulációi révén a jrest.php szkriptnél, ahol külső paraméterek használatosak a fájlnév megformálásához, amelyet a 'require_once()' funkció tölt be (például '/jrest.php?payload=alol/lol/any\..\..\..\..\any\file').
Forrás: opennet.ru
