{"id":105422,"date":"2022-10-30T21:36:53","date_gmt":"2022-10-30T19:36:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos"},"modified":"2022-10-30T21:36:53","modified_gmt":"2022-10-30T19:36:53","slug":"uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/news\/uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos","title":{"rendered":"V\u0101j\u012bbas Juniper t\u012bkla ier\u012b\u010du t\u012bmek\u013ca saskarn\u0113, kas tiek pieg\u0101d\u0101tas ar JunOS.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
J-Web t\u012bmek\u013ca saskarn\u0113, ko izmanto Juniper uz\u0146\u0113muma t\u012bkla iek\u0101rt\u0101s ar JunOS oper\u0113t\u0101jprogrammu, tika atkl\u0101tas vair\u0101kas ievainojam\u012bbas, no kur\u0101m visb\u012bstam\u0101k\u0101 (CVE-2022-22241) \u013cauj att\u0101lin\u0101ti, neizpildot autentifik\u0101ciju, izpild\u012bt savu kodu sist\u0113m\u0101, nos\u016btot \u012bpa\u0161i sagatavotu HTTP piepras\u012bjumu. Juniper iek\u0101rtu lietot\u0101jiem ieteicams instal\u0113t aparat\u016bras jaunin\u0101jumu, bet, ja tas nav iesp\u0113jams, j\u0101nodro\u0161ina piek\u013cuve t\u012bmek\u013ca saskarnei tiek blo\u0137\u0113ta no \u0101r\u0113j\u0101m t\u012bkl\u0101m un ierobe\u017eota tikai uz uzticamiem hostiem. <\/p>\n
Vain\u012bga ir v\u0101j\u012bba, ka lietot\u0101ja ievad\u012btais faila ce\u013c\u0161 tiek apstr\u0101d\u0101ts skript\u0101 \/jsdm\/ajax\/logging_browse.php bez satura tipa prefiksa filtr\u0113\u0161anas autentifik\u0101cijas p\u0101rbaudes posm\u0101. Uzbruc\u0113js var nodot \u013caunpr\u0101t\u012bgu phar failu k\u0101 att\u0113lu un pan\u0101kt taj\u0101 uzglab\u0101t\u0101 PHP koda izpildi, izmantojot uzbrukuma metodi 'Phar deserialization' (piem\u0113ram, nor\u0101dot piepras\u012bjum\u0101 'filepath=phar:\/ce\u013c\u0161\/pharfile.jpg'). <\/p>\n
Probl\u0113ma ir t\u0101da, ka, p\u0101rbaudot aug\u0161upiel\u0101d\u0113to failu ar PHP funkciju is_dir(), \u0161\u012b funkcija autom\u0101tiski veic metadatu deserializ\u0101ciju no Phar arh\u012bva (PHP Archive), apstr\u0101d\u0101jot ce\u013cus, kas s\u0101kas ar 'phar:\/\/'. L\u012bdz\u012bgs efekts nov\u0113rojams, apstr\u0101d\u0101jot lietot\u0101ja nodotos faila ce\u013cus funkcij\u0101s file_get_contents(), fopen(), file(), file_exists(), md5_file(), filemtime() un filesize(). <\/p>\n
Uzbrukumu sare\u017e\u0123\u012b tas, ka, izsaucot phar arh\u012bvu, uzbruc\u0113jam ir j\u0101atrod veids, k\u0101 to aug\u0161upiel\u0101d\u0113t ier\u012bc\u0113 (ar piek\u013cuvi \/jsdm\/ajax\/logging_browse.php var tikai nor\u0101d\u012bt ce\u013cu, lai izpild\u012btu jau eso\u0161u failu). No iesp\u0113jamajiem failu piek\u013cuves scen\u0101rijiem tiek min\u0113ta phar faila aug\u0161upiel\u0101de k\u0101 att\u0113ls caur att\u0113lu p\u0101rs\u016bt\u012b\u0161anas servisu un faila ielik\u0161ana t\u012bmek\u013ca satura ke\u0161atmi\u0146\u0101. <\/p>\n
Citas ievainojam\u012bbas: <\/p>\n
\n
CVE-2022-22242 \u2014 nefiltr\u0113tu \u0101r\u0113ju parametru iek\u013cau\u0161ana skripta error.php izej\u0101, kas \u013cauj pan\u0101kt starpdom\u0113nu skriptu un izpild\u012bt lietot\u0101ja p\u0101rl\u016bkprogramm\u0101 jebk\u0101du JavaScript kodu, p\u0101rejot uz saiti (piem\u0113ram, 'https:\/\/JUNOS_IP\/error.php?SERVER_NAME='). V\u0101j\u012bba var tikt izmantota, lai nozagtu administratora sesiju parametrus, ja uzbruc\u0113jam izdodas atv\u0113rt administratoram \u012bpa\u0161i izstr\u0101d\u0101tu saiti.\n
CVE-2022-22243, CVE-2022-22244 \u2014 XPath izteiksmju iek\u013cau\u0161ana, izmantojot skriptus jsdm\/ajax\/wizards\/setup\/setup.php un \/modules\/monitor\/interfaces\/interface.php, \u013cauj neprivileg\u0113tam autentific\u0113tam lietot\u0101jam manipul\u0113t ar administratora sesij\u0101m.\n
CVE-2022-22245 \u2014 nepietiekama '..' sec\u012bbas att\u012br\u012b\u0161ana ce\u013cos, kas apstr\u0101d\u0101ti skript\u0101 Upload.php, \u013cauj autentific\u0113tam lietot\u0101jam aug\u0161upiel\u0101d\u0113t savu PHP failu katalog\u0101, kur\u0101 ir iesp\u0113jama PHP skriptu izpilde (piem\u0113ram, nor\u0101dot ce\u013cu 'fileName=............wwwdirnewshell.php').\n
CVE-2022-22246 \u2014 iesp\u0113ja izpild\u012bt jebkuru lok\u0101lo PHP failu, manipul\u0113jot ar autentific\u0113t\u0101 lietot\u0101ja skriptu jrest.php, kur \u0101r\u0113jie parametri tiek izmantoti, lai veidotu faila nosaukumu, ko iel\u0101d\u0113 funkcija 'require_once()' (piem\u0113ram, '\/jrest.php?payload=alol\/lol\/any............anyfile'). <\/ul>\n