CVE-2020-1673 Information

Description

Insufficient Cross-Site Scripting (XSS) protection in Juniper Networks J-Web and web based (HTTP/HTTPS) services allows an unauthenticated attacker to hijack the target user’s HTTP/HTTPS session and perform administrative actions on the Junos device as the targeted user. This issue only affects Juniper Networks Junos OS devices with HTTP/HTTPS services enabled such as J-Web Web Authentication Dynamic-VPN (DVPN) Firewall Authentication Pass-Through with Web-Redirect and Zero Touch Provisioning (ZTP). Junos OS devices with HTTP/HTTPS services disabled are not affected. If HTTP/HTTPS services are enabled the following command will show the httpd processes: user@device show system processes | match http 5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd –config /jail/var/etc/httpd.conf In order to successfully exploit this vulnerability the attacker needs to convince the device administrator to take action such as clicking the crafted URL sent via phishing email or convince the administrator to input data in the browser console. This issue affects Juniper Networks Junos OS: 18.1 versions prior to 18.1R3-S1; 18.2 versions prior to 18.2R3-S5; 18.3 versions prior to 18.3R2-S4 18.3R3-S2; 18.4 versions prior to 18.4R2-S5 18.4R3-S2; 19.1 versions prior to 19.1R2-S2 19.1R3-S1; 19.2 versions prior to 19.2R1-S5 19.2R2; 19.3 versions prior to 19.3R2-S4 19.3R3; 19.4 versions prior to 19.4R1-S3 19.4R2; 20.1 versions prior to 20.1R1-S2 20.1R2. This issue does not affect Juniper Networks Junos OS prior to 18.1R1.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Reference

https://kb.juniper.net/JSA11070

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

REQUIRED

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

8.8