A J-Web web interface, used in network devices from Juniper equipped with the JunOS operating system, has several vulnerabilities, the most dangerous of which (CVE-2022-22241) allows remote code execution without authentication by sending specially crafted HTTP requests. Users of Juniper equipment are advised to update their firmware, and if this is not possible, to ensure that access to the web interface is blocked from external networks and limited to trusted hosts. <\/p>\n
A sebezhet\u0151s\u00e9g l\u00e9nyeg\u00e9t az adja, hogy a felhaszn\u00e1l\u00f3 \u00e1ltal megadott f\u00e1jl\u00fatvonalat a \/jsdm\/ajax\/logging_browse.php szkriptben a hiteles\u00edt\u00e9s ellen\u0151rz\u00e9se el\u0151tt, a tartalomt\u00edpus el\u0151tagj\u00e1nak sz\u0171r\u00e9se n\u00e9lk\u00fcl dolgozz\u00e1k fel. A t\u00e1mad\u00f3 k\u00e9pes egy k\u00e1rt\u00e9kony phar f\u00e1jlt \u00e1tadni k\u00e9pk\u00e9nt, \u00e9s \u00edgy a phar arch\u00edvumban elhelyezett PHP k\u00f3dot v\u00e9grehajtani a 'Phar deserialization' t\u00e1mad\u00e1si m\u00f3dszer kihaszn\u00e1l\u00e1s\u00e1val (p\u00e9ld\u00e1ul a k\u00e9r\u00e9sben: 'filepath=phar:\/\u00fatvonal\/pharfile.jpg' megad\u00e1s\u00e1val). <\/p>\n
A probl\u00e9ma az, hogy a felt\u00f6lt\u00f6tt f\u00e1jl ellen\u0151rz\u00e9sekor, a PHP is_dir() funkci\u00f3val, ez a funkci\u00f3 automatikusan deszerializ\u00e1lja a Phar arch\u00edvum metainform\u00e1ci\u00f3it a 'phar:\/\/' -ral kezd\u0151d\u0151 utak feldolgoz\u00e1sa sor\u00e1n. Hasonl\u00f3 hat\u00e1s figyelhet\u0151 meg a felhaszn\u00e1l\u00f3 \u00e1ltal megadott f\u00e1jl\u00fatvonalak kezel\u00e9sekor az file_get_contents(), fopen(), file(), file_exists(), md5_file(), filemtime() \u00e9s filesize() funkci\u00f3kban. <\/p>\n
The attack is complicated by the fact that, in addition to initiating the execution of the phar archive, the attacker must find a way to upload it to the device (accessing \/jsdm\/ajax\/logging_browse.php only allows specifying a path for executing an already existing file). Among the possible scenarios for getting files onto the device, the uploading of a phar file disguised as an image through an image transfer service and injecting a file into the web content cache are mentioned. <\/p>\n
Egy\u00e9b sebezhet\u0151s\u00e9gek: <\/p>\n
\n
CVE-2022-22242 \u2014 nem sz\u0171rt k\u00fcls\u0151 param\u00e9terek beilleszt\u00e9se az error.php szkript kimenet\u00e9be, lehet\u0151v\u00e9 t\u00e9ve a keresztoldali szkriptek futtat\u00e1s\u00e1t, \u00e9s tetsz\u0151leges JavaScript k\u00f3d v\u00e9grehajt\u00e1s\u00e1t a felhaszn\u00e1l\u00f3 b\u00f6ng\u00e9sz\u0151j\u00e9ben egy hivatkoz\u00e1s k\u00f6vet\u00e9sekor (p\u00e9ld\u00e1ul: 'https:\/\/JUNOS_IP\/error.php?SERVER_NAME='). A sebezhet\u0151s\u00e9g felhaszn\u00e1lhat\u00f3 az adminisztr\u00e1tori munkamenet param\u00e9tereinek megszerz\u00e9s\u00e9re, ha a t\u00e1mad\u00f3 k\u00e9pes kinyitni egy kifejezetten elk\u00e9sz\u00edtett hivatkoz\u00e1st az adminisztr\u00e1tor el\u0151tt.\n
CVE-2022-22243, CVE-2022-22244 \u2014 XPATH kifejez\u00e9sek beilleszt\u00e9se a jsdm\/ajax\/wizards\/setup\/setup.php \u00e9s \/modules\/monitor\/interfaces\/interface.php szkriptekbe, lehet\u0151v\u00e9 t\u00e9ve nem privilegiz\u00e1lt hiteles\u00edtett felhaszn\u00e1l\u00f3k sz\u00e1m\u00e1ra az adminisztr\u00e1tori munkamenetek manipul\u00e1l\u00e1s\u00e1t.\n
CVE-2022-22245 \u2014 a '..' szekvencia megfelel\u0151 tiszt\u00edt\u00e1s\u00e1nak hi\u00e1nya az Upload.php szkriptben feldolgozott utakban lehet\u0151v\u00e9 teszi, hogy egy hiteles\u00edtett felhaszn\u00e1l\u00f3 PHP f\u00e1jlt t\u00f6lts\u00f6n fel egy PHP script futtat\u00e1s\u00e1ra alkalmas k\u00f6nyvt\u00e1rba (p\u00e9ld\u00e1ul: 'fileName=\\..\\..\\..\\..\\www\\dir\\new\\shell.php' megad\u00e1s\u00e1val).\n
CVE-2022-22246 \u2014 tetsz\u0151leges helyi PHP f\u00e1jl v\u00e9grehajt\u00e1s\u00e1nak lehet\u0151s\u00e9ge egy hiteles\u00edtett felhaszn\u00e1l\u00f3 manipul\u00e1ci\u00f3j\u00e1val a jrest.php szkripttel, ahol a k\u00fcls\u0151 param\u00e9tereket a 'require_once()' funkci\u00f3 \u00e1ltal bet\u00f6ltend\u0151 f\u00e1jl nev\u00e9nek megalkot\u00e1s\u00e1hoz haszn\u00e1lj\u00e1k (p\u00e9ld\u00e1ul: '\/jrest.php?payload=alol\/lol\/any\\..\\..\\..\\..\\any\\file' megad\u00e1s\u00e1val). <\/ul>\n