Product Affected

These issues affect all versions of Junos OS.
High
8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Problem

Multiple vulnerabilities have been found in the J-Web component of Juniper Networks Junos OS. One or more of these issues could lead to unauthorized local file access, cross-site scripting attacks, path injection and traversal, or local file inclusion.


A weak cipher used for checking file integrity was also reported, but had been resolved in earlier releases of Junos OS.


These issues affect Juniper Networks Junos OS:

  • All versions prior to 19.1R3-S9;
  • 19.2 versions prior to 19.2R3-S6;
  • 19.3 versions prior to 19.3R3-S7;
  • 19.4 versions prior to 19.4R3-S9;
  • 20.1 versions prior to 20.1R3-S5;
  • 20.2 versions prior to 20.2R3-S5;
  • 20.3 versions prior to 20.3R3-S5;
  • 20.4 versions prior to 20.4R3-S4;
  • 21.1 versions prior to 21.1R3-S2;
  • 21.2 versions prior to 21.2R3-S1;
  • 21.3 versions prior to 21.3R3;
  • 21.4 versions prior to 21.4R3;
  • 22.1 versions prior to 22.1R2.


These issues were discovered during external security research.

The specific issues reported and resolved are listed below:

CVECVSSSummary
CVE-2022-222418.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)An Improper Input Validation vulnerability in the J-Web component of Juniper Networks Junos OS may allow an unauthenticated attacker to access data without proper authorization. Utilizing a crafted POST request, deserialization may occur which could lead to unauthorized local file access or the ability to execute arbitrary commands.
CVE-2022-222426.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scripts reflected off of J-Web to the victim's browser in the context of their session within J-Web.
CVE-2022-222434.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)An XPath Injection vulnerability due to Improper Input Validation in the J-Web component of Juniper Networks Junos OS allows an authenticated attacker to add an XPath command to the XPath stream, which may allow chaining to other unspecified vulnerabilities, leading to a partial loss of confidentiality.
CVE-2022-222445.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)An XPath Injection vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker sending a crafted POST to reach the XPath channel, which may allow chaining to other unspecified vulnerabilities, leading to a partial loss of confidentiality.
CVE-2022-222454.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)A Path Traversal vulnerability in the J-Web component of Juniper Networks Junos OS allows an authenticated attacker to upload arbitrary files to the device by bypassing validation checks built into Junos OS. The attacker should not be able to execute the file due to validation checks built into Junos OS. Successful exploitation of this vulnerability could lead to loss of filesystem integrity.
CVE-2022-222467.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)A PHP Local File Inclusion (LFI) vulnerability in the J-Web component of Juniper Networks Junos OS may allow a low-privileged authenticated attacker to execute an untrusted PHP file. By chaining this vulnerability with other unspecified vulnerabilities, and by circumventing existing attack requirements, successful exploitation could lead to a complete system compromise.

Solution

The following software releases have been updated to resolve these specific issues: Junos OS 19.1R3-S9, 19.2R3-S6, 19.3R3-S7, 19.4R3-S9, 20.1R3-S5, 20.2R3-S5, 20.3R3-S5, 20.4R3-S4, 21.1R3-S2, 21.3R3, 21.4R3, 22.1R2, 22.2R1, and all subsequent releases.

These issues are being tracked as 1656805, 1656806, 1656808, 1656809, 1656810 and 1656811 which are visible on the Customer Support website.

Note: Juniper SIRT's policy is not to evaluate releases which are beyond End of Engineering (EOE) or End of Life (EOL).

IMPLEMENTATION:

Software Releases, patches and updates are available at https://support.juniper.net/support/downloads/.

Workaround

Disable J-Web, or limit access to only trusted hosts.

Severity Assessment

Information for how Juniper Networks uses CVSS can be found at KB 16446 [juniper.net] "Common Vulnerability Scoring System (CVSS) and Juniper's Security Advisories."

Modification History

2022-10-12: Initial Publication.

Related Information

Acknowledgements

The Juniper SIRT would like to would like to acknowledge and thank Paulos Yibelo from Octagon Networks (octagon.net) for responsibly reporting these vulnerabilities.