{"id":105422,"date":"2022-10-30T21:36:53","date_gmt":"2022-10-30T19:36:53","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos"},"modified":"2022-10-30T21:36:53","modified_gmt":"2022-10-30T19:36:53","slug":"uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos","title":{"rendered":"Vulnerabilit\u0103\u021bi \u00een interfa\u021ba web a dispozitivelor de re\u021bea Juniper, livrate cu JunOS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>\u00cen interfa\u021ba web J-Web, utilizat\u0103 \u00een dispozitivele de re\u021bea ale companiei Juniper dotate cu sistemul de operare JunOS, au fost identificate mai multe vulnerabilit\u0103\u021bi, cea mai periculoas\u0103 dintre ele (CVE-2022-22241) permi\u021b\u00e2nd executarea de cod \u00een sistem de la distan\u021b\u0103 f\u0103r\u0103 autentificare prin trimiterea unei cereri HTTP special concepute. Utilizatorilor echipamentelor Juniper li se recomand\u0103 s\u0103 instaleze actualiz\u0103ri de firmware, iar dac\u0103 acest lucru nu este posibil, s\u0103 se asigure c\u0103 accesul la interfa\u021ba web este blocat din re\u021bele externe \u0219i limitat doar la gazde de \u00eencredere.      <\/p>\n<p>Vulnerabilitatea const\u0103 \u00een faptul c\u0103 calea de fi\u0219ier transmis\u0103 de utilizator este procesat\u0103 \u00een scriptul \/jsdm\/ajax\/logging_browse.php f\u0103r\u0103 a filtra prefixul cu tipul de con\u021binut \u00eenainte de verificarea autentific\u0103rii. Un atacator poate transmite un fi\u0219ier PHP malicios sub forma unei imagini \u0219i poate executa cod PHP din arhiva phar utiliz\u00e2nd metoda de atac \u201ePhar deserialization\u201d (de exemplu, specific\u00e2nd \u00een cerere \u201efilepath=phar:\/cale\/pharfile.jpg\u201d).     <\/p>\n<p>Problema este c\u0103, la verificarea fi\u0219ierului \u00eenc\u0103rcat cu func\u021bia PHP is_dir(), aceast\u0103 func\u021bie realizeaz\u0103 automat deserializarea metadatelor din arhiva Phar (PHP Archive) atunci c\u00e2nd proceseaz\u0103 c\u0103ile care \u00eencep cu \u201ephar:\/\/\u201d. Un efect similar se observ\u0103 \u0219i la procesarea c\u0103ilor de fi\u0219ier transmise de utilizator \u00een func\u021biile file_get_contents(), fopen(), file(), file_exists(), md5_file(), filemtime() \u0219i filesize().     <\/p>\n<p>Atacul este complicat de faptul c\u0103 pe l\u00e2ng\u0103 ini\u021bierea execut\u0103rii arhivei phar, atacatorul trebuie s\u0103 g\u0103seasc\u0103 o modalitate de a o \u00eenc\u0103rca pe dispozitiv (prin accesarea \/jsdm\/ajax\/logging_browse.php se poate specifica doar calea pentru executarea unui fi\u0219ier deja existent). Scenariile posibile pentru transferul fi\u0219ierelor pe dispozitiv includ \u00eenc\u0103rcarea fi\u0219ierului phar sub form\u0103 de imagine printr-un serviciu de transfer al imaginilor \u0219i inserarea fi\u0219ierului \u00een cache-ul con\u021binutului web.    <\/p>\n<p>Alte vulnerabilit\u0103\u021bi:  <\/p>\n<ul>\n<li class=\"l\"> CVE-2022-22242 \u2014 substituirea parametrilor externi nefiltra\u021bi \u00een ie\u0219irea scriptului error.php, ceea ce permite atacuri cross-site scripting \u0219i executarea de cod JavaScript arbitrar \u00een browserul utilizatorului prin accesarea unui link (de exemplu, \u201ehttps:\/\/JUNOS_IP\/error.php?SERVER_NAME=\u201d). Vulnerabilitatea poate fi utilizat\u0103 pentru interceptarea parametrilor sesiunii administratorului, dac\u0103 atacatorul reu\u0219e\u0219te s\u0103 conving\u0103 administratorul s\u0103 deschid\u0103 un link special conceput.\n<li class=\"l\"> CVE-2022-22243, CVE-2022-22244 \u2014 substituirea expresiilor XPATH prin scripturile jsdm\/ajax\/wizards\/setup\/setup.php \u0219i \/modules\/monitor\/interfaces\/interface.php, permite unui utilizator autenticat f\u0103r\u0103 privilegii s\u0103 manipuleze sesiunile administratorilor.\n<li class=\"l\"> CVE-2022-22245 \u2014 lipsa unei cur\u0103\u021b\u0103ri adecvate a secven\u021bei \u201e..\u201d \u00een c\u0103ile procesate \u00een scriptul Upload.php permite unui utilizator autenticat s\u0103 \u00eencarce un fi\u0219ier PHP \u00een directorul care permite execu\u021bia scripturilor PHP (de exemplu, transmit\u00e2nd calea \u201efileName=..\\..\\..\\..\\www\\dir\\new\\shell.php\u201d).\n<li class=\"l\"> CVE-2022-22246 \u2014 posibilitatea de a executa un fi\u0219ier local PHP arbitrar prin manipularea scriptului jrest.php de c\u0103tre un utilizator autenticat, \u00een care parametrii externi sunt utiliza\u021bi pentru a forma numele fi\u0219ierului \u00eenc\u0103rcat cu func\u021bia \u201erequire_once()\u201d (de exemplu, \u201e\/jrest.php?payload=alol\/lol\/any\\..\\..\\..\\..\\any\\file\u201d).      <\/ul>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/www.opennet.ru\/opennews\/art.shtml?num=58010\">opennet.ro<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0412 web-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 J-Web, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Juniper, \u043e\u0441\u043d\u0430\u0449\u0451\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 JunOS, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 (CVE-2022-22241) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0431\u0435\u0437 \u043f\u0440\u043e\u0445\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u043a\u043e\u0434 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0447\u0435\u0440\u0435\u0437 \u043e\u0442\u043f\u0440\u0430\u0432\u043a\u0443 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0444\u043e\u0440\u043c\u043b\u0435\u043d\u043d\u043e\u0433\u043e HTTP-\u0437\u0430\u043f\u0440\u043e\u0441\u0430. \u041f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c \u043e\u0431\u043e\u0440\u0443\u0434\u043e\u0432\u0430\u043d\u0438\u044f Juniper \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u043e\u0432\u0430\u043d\u043e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438, \u0430 \u0435\u0441\u043b\u0438 \u044d\u0442\u043e \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e, \u043f\u0440\u043e\u0441\u043b\u0435\u0434\u0438\u0442\u044c, \u0447\u0442\u043e\u0431\u044b \u0434\u043e\u0441\u0442\u0443\u043f \u043a web-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u0431\u044b\u043b \u0437\u0430\u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-105422","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0412 web-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 J-Web, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Juniper, \u043e\u0441\u043d\u0430\u0449\u0451\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 JunOS, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 (CVE-2022-22241) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 web-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 Juniper, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0441 JunOS | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0412 web-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 J-Web, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Juniper, \u043e\u0441\u043d\u0430\u0449\u0451\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 JunOS, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 (CVE-2022-22241) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2022-10-30T19:36:53+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2022-10-30T19:36:53+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47Vulnerabilit\u0103\u021bi \u00een interfa\u021ba web a dispozitivelor de re\u021bea Juniper, livrate cu JunOS | ProHoster","description":"\u00cen interfa\u021ba web J-Web, care este utilizat\u0103 \u00een dispozitivele de re\u021bea ale companiei Juniper, echipate cu sistemul de operare JunOS, au fost identificate mai multe vulnerabilit\u0103\u021bi, cea mai periculoas\u0103 dintre ele (CVE-2022-22241) permi\u021b\u00e2nd.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 web-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 Juniper, \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0441 JunOS | ProHoster","og:description":"\u0412 web-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0435 J-Web, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0432 \u0441\u0435\u0442\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Juniper, \u043e\u0441\u043d\u0430\u0449\u0451\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 JunOS, \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043e \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043d\u0430\u0438\u0431\u043e\u043b\u0435\u0435 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 (CVE-2022-22241) \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442.","og:url":"https:\/\/prohoster.info\/ro\/blog\/news\/uyazvimosti-v-web-interfejse-setevyh-ustrojstv-juniper-postavlyaemyh-s-junos","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2022-10-30T19:36:53+00:00","article:modified_time":"2022-10-30T19:36:53+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/105422","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=105422"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/105422\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=105422"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=105422"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=105422"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}