CVE-2020-1631

KEV

Published: Mag 04, 2020 Last Modified: Ott 24, 2025 EU-VD ID: EUVD-2020-12499 Aliases: GSD-2020-1631

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 8,8

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: none

User Interaction: required

Scope: unchanged

Confidentiality: high

Integrity: high

Availability: high

MEDIUM 6,8

Source: [email protected]

Access Vector: network

Access Complexity: medium

Authentication: none

Confidentiality: partial

Integrity: partial

Availability: partial

Description

AI Translation Available

A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal. Using this vulnerability, an attacker may be able to inject commands into the httpd.log, read files with 'world' readable permission file or obtain J-Web session tokens. In the case of command injection, as the HTTP service runs as user 'nobody', the impact of this command injection is limited. (CVSS score 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) In the case of reading files with 'world' readable permission, in Junos OS 19.3R1 and above, the unauthenticated attacker would be able to read the configuration file. (CVSS score 5.9, vector CVSS:3.1/ AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) If J-Web is enabled, the attacker could gain the same level of access of anyone actively logged into J-Web. If an administrator is logged in, the attacker could gain administrator access to J-Web. (CVSS score 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) This issue only affects Juniper Networks Junos OS devices with HTTP/HTTPS services enabled. Junos OS devices with HTTP/HTTPS services disabled are not affected. If HTTP/HTTPS services are enabled, the following command will show the httpd processes: user@device> show system processes | match http 5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd --config /jail/var/etc/httpd.conf To summarize: If HTTP/HTTPS services are disabled, there is no impact from this vulnerability. If HTTP/HTTPS services are enabled and J-Web is not in use, this vulnerability has a CVSS score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). If J-Web is enabled, this vulnerability has a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Juniper SIRT has received a single report of this vulnerability being exploited in the wild. Out of an abundance of caution, we are notifying customers so they can take appropriate actions. Indicators of Compromise: The /var/log/httpd.log may have indicators that commands have injected or files being accessed. The device administrator can look for these indicators by searching for the string patterns '=*;*&' or '*%3b*&' in /var/log/httpd.log, using the following command: user@device> show log httpd.log | match '=*;*&|=*%3b*&' If this command returns any output, it might be an indication of malicious attempts or simply scanning activities. Rotated logs should also be reviewed, using the following command: user@device> show log httpd.log.0.gz | match '=*;*&|=*%3b*&' user@device> show log httpd.log.1.gz | match '=*;*&|=*%3b*&' Note that a skilled attacker would likely remove these entries from the local log file, thus effectively eliminating any reliable signature that the device had been attacked. This issue affects Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S16; 12.3X48 versions prior to 12.3X48-D101, 12.3X48-D105; 14.1X53 versions prior to 14.1X53-D54; 15.1 versions prior to 15.1R7-S7; 15.1X49 versions prior to 15.1X49-D211, 15.1X49-D220; 16.1 versions prior to 16.1R7-S8; 17.2 versions prior to 17.2R3-S4; 17.3 versions prior to 17.3R3-S8; 17.4 versions prior to 17.4R2-S11, 17.4R3-S2; 18.1 versions prior to 18.1R3-S10; 18.2 versions prior to 18.2R2-S7, 18.2R3-S4; 18.3 versions prior to 18.3R2-S4, 18.3R3-S2; 18.4 versions prior to 18.4R1-S7, 18.4R3-S2 ; 18.4 version 18.4R2 and later versions; 19.1 versions prior to 19.1R1-S5, 19.1R3-S1; 19.1 version 19.1R2 and later versions; 19.2 versions prior to 19.2R2; 19.3 versions prior to 19.3R2-S3, 19.3R3; 19.4 versions prior to 19.4R1-S2, 19.4R2; 20.1 versions prior to 20.1R1-S1, 20.1R2.

AI Generated Translation

Una vulnerabilità nel servizio HTTP/HTTPS utilizzato da J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through con Web-Redirect e Zero Touch Provisioning (ZTP) consente a un attaccante non autenticato di eseguire inclusioni di file locali (LFI) o traversal di percorso. Utilizzando questa vulnerabilità, un attaccante potrebbe essere in grado di iniettare comandi nel file httpd.log, leggere file con permesso di lettura 'world' o ottenere token di sessione J-Web. Nel caso di iniezione di comandi, poiché il servizio HTTP viene eseguito come utente 'nobody', l'impatto di questa iniezione di comandi è limitato. (CVSS score 5.3, vettore CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Nel caso di lettura di file con permesso di lettura 'world', su Junos OS 19.3R1 e versioni successive, l'attaccante non autenticato potrebbe leggere il file di configurazione. (CVSS score 5.9, vettore CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Se J-Web è abilitato, l'attaccante potrebbe ottenere lo stesso livello di accesso di chiunque sia attivamente connesso a J-Web. Se un amministratore è connesso, l'attaccante potrebbe ottenere accesso amministrativo a J-Web. (CVSS score 8.8, vettore CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Questo problema riguarda esclusivamente dispositivi Juniper Networks Junos OS con servizi HTTP/HTTPS abilitati. Dispositivi Junos OS con servizi HTTP/HTTPS disabilitati non sono interessati. Se i servizi HTTP/HTTPS sono abilitati, il seguente comando mostrerà i processi httpd:
user@device> show system processes | match http
5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd --config /jail/var/etc/httpd.conf

In sintesi:
Se i servizi HTTP/HTTPS sono disabilitati, questa vulnerabilità non ha impatti.
Se i servizi HTTP/HTTPS sono abilitati e J-Web non è in uso, questa vulnerabilità ha un punteggio CVSS di 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).
Se J-Web è abilitato, questa vulnerabilità ha un punteggio CVSS di 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Il team Juniper SIRT ha ricevuto una singola segnalazione di questa vulnerabilità sfruttata in ambienti reali. Per cautela, stiamo notificando i clienti affinché possano adottare le misure appropriate.

Indicatori di compromissione:
Il file /var/log/httpd.log potrebbe mostrare indicatori di comandi iniettati o accesso a file.
L’amministratore del dispositivo può cercare tali indicatori cercando le stringhe "=*;*&" o "*%3b*&" in /var/log/httpd.log, utilizzando il seguente comando:
user@device> show log httpd.log | match "=*;*&|=*%3b*&"
Se questo comando restituisce output, potrebbe indicare tentativi malevoli o attività di scansione.
I log ruotati devono essere anch’essi verificati, utilizzando i seguenti comandi:
user@device> show log httpd.log.0.gz | match "=*;*&|=*%3b*&"
user@device> show log httpd.log.1.gz | match "=*;*&|=*%3b*&"

Si noti che un attaccante esperto potrebbe rimuovere queste voci dal file di log locale, eliminando efficacemente qualsiasi firma affidabile che il dispositivo sia stato attaccato.

Questo problema interessa i dispositivi Juniper Networks Junos OS nelle versioni precedenti a 12.3R12-S16; 12.3X48 precedenti a 12.3X48-D101, 12.3X48-D105; 14.1X53 precedenti a 14.1X53-D54; 15.1 precedenti a 15.1R7-S7; 15.1X49 precedenti a 15.1X49-D211, 15.1X49-D220; 16.1 precedenti a 16.1R7-S8; 17.2 precedenti a 17.2R3-S4; 17.3 precedenti a 17.3R3-S8; 17.4 precedenti a 17.4R2-S11, 17.4R3-S2; 18.1 precedenti a 18.1R3-S10; 18.2 precedenti a 18.2R2-S7, 18.2R3-S4; 18.3 precedenti a 18.3R2-S4, 18.3R3-S2; 18.4 precedenti a 18.4R1-S7, 18.4R3-S2; 18.4 versione 18.4R2 e successive; 19.1 precedenti a 19.1R1-S5, 19.1R3-S1; 19.1 versione 19.1R2 e successive; 19.2 precedenti a 19.2R2; 19.3 precedenti a 19.3R2-S3, 19.3R3; 19.4 precedenti a 19.4R1-S2, 19.4R2; 20.1 precedenti a 20.1R1-S1, 20.1R2.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score

0,0530

Percentile

0,9th

Updated

EPSS Score Trend (Last 91 Days)

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Stable

Abstraction: Base Structure: Simple

Common Consequences

Security Scopes Affected:

Integrity Confidentiality Availability

Potential Impacts:

Execute Unauthorized Code Or Commands Modify Files Or Directories Read Files Or Directories Dos: Crash, Exit, Or Restart

Applicable Platforms

Technologies: AI/ML

Likelihood of Exploit: High

View CWE Details

External Control of File Name or Path

Draft

Abstraction: Base Structure: Simple

Common Consequences

Security Scopes Affected:

Integrity Confidentiality Availability

Potential Impacts:

Read Files Or Directories Modify Files Or Directories Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Other)

Applicable Platforms

Operating Systems: Unix, Windows, macOS

Likelihood of Exploit: High

View CWE Details

Operating System

Junos by Juniper

Product Information

Vendor Juniper

Product Junos

Version 12.3

CPE Identifier