A configuration weakness in the JettyAdminServer dependency for the Apache ZooKeeper component of Juniper Networks NorthStar Controller allows an attacker to debug web server connections using the TRACE and/or TRACK methods which can allow remote attackers to steal information using cross-site tracing (XST) attacks in applications that are vulnerable to cross-site scripting (XSS) attacks to successfully access a session token.

This issue affects:

Juniper Networks NorthStar Controller

• 5.1 versions prior to 5.1.1;
• 6.0 versions prior to 6.0.3;
• 6.1 versions prior to 6.1.0 Service Pack 3;
• 6.2 versions prior to 6.2.0 Service Pack 1.

Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

This issue was discovered during external security research.

This issue has been assigned  CVE-2004-2320

The following software releases have been updated to resolve this specific issue: NorthStar Controller 5.1.1, 6.0.3, 6.1.0 Service Pack 3, 6.2.0 Service Pack 1, and all subsequent releases.

This issue is being tracked as  1536485 .

Software releases or updates are available for download at https://support.juniper.net/support/downloads/

To work around this issue manually edit the zookeeper cfg file and disable the admin port on port 8080.

First, edit the zoo.cfg file located at /opt/northstar/thirdparty/zookeeper/conf/zoo.cfg

and add this at the end:

Then restart zookeeper.

Note: This option will disable the adminserver which by default is listening on port 8080.

2021-10-13: Initial Publication.

• KB16613: Overview of the Juniper Networks SIRT Quarterly Security Bulletin Publication Process [juniper.net]
• KB16765: In which releases are vulnerabilities fixed? [juniper.net]
• KB16446: Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories [juniper.net]
• Report a Vulnerability - How to Contact the Juniper Networks Security Incident Response Team
• CVE-2004-2320 at cve.mitre.org
• issues.apache.org JettyAdminServer should not allow HTTP TRACE method