CVE-2020-1631
published 2020-05-04CVE-2020-1631: A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and…
PriorityP186critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2022-04-15
Exploited in the wild
EPSS
4.72%
90.8th percentile
A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal. Using this vulnerability, an attacker may be able to inject commands into the httpd.log, read files with 'world' readable permission file or obtain J-Web session tokens. In the case of command injection, as the HTTP service runs as user 'nobody', the impact of this command injection is limited. (CVSS score 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) In the case of reading files with 'world' readable permission, in Junos OS 19.3R1 and above, the unauthenticated attacker would be able to read the configuration file. (CVSS score 5.9, vector CVSS:3.1/ AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) If J-Web is enabled, the attacker could gain the same level of access of anyone actively logged into J-Web. If an administrator is logged in, the attacker could gain administrator access to J-Web. (CVSS score 8.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) This issue only affects Juniper Networks Junos OS devices with HTTP/HTTPS services enabled. Junos OS devices with HTTP/HTTPS services disabled are not affected. If HTTP/HTTPS services are enabled, the following command will show the httpd processes: user@device> show system processes | match http 5260 - S 0:00.13 /usr/sbin/httpd-gk -N 5797 - I 0:00.10 /usr/sbin/httpd --config /jail/var/etc/httpd.conf To summarize: If HTTP/HTTPS services are disabled, there is no impact from this vulnerability. If HTTP/HTTPS services are enabled and J-Web is not in use, this vulnerability has a CVSS score of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). If J-Web is enabled, this vulnerability has a CVSS score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Juniper SIRT has received a single report of this vulnerability being exploited in the
Affected
38 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | j-web | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos_os | — | — |
| juniper_networks | junos_os | >= 12.3 < 12.3R12-S16 | 12.3R12-S16 |
| juniper_networks | junos_os | >= 12.3X48 < 12.3X48-D101, 12.3X48-D105 | 12.3X48-D101, 12.3X48-D105 |
| juniper_networks | junos_os | >= 14.1X53 < 14.1X53-D54 | 14.1X53-D54 |
| juniper_networks | junos_os | >= 15.1 < 15.1R7-S7 | 15.1R7-S7 |
| juniper_networks | junos_os | >= 15.1X49 < 15.1X49-D211, 15.1X49-D220 | 15.1X49-D211, 15.1X49-D220 |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
=*;*&
bytes↗
*%3b*&
- →Search for semicolon-based command injection patterns in httpd.log — both URL-encoded (%3b) and literal (;) forms indicate potential exploitation of the LFI/path traversal vulnerability. ↗
- →Review rotated/compressed log files (httpd.log.0.gz, httpd.log.1.gz) for the same injection patterns, as attackers may have been active before log rotation. ↗
- →Absence of log entries does not rule out compromise — a skilled attacker may have tampered with local logs to remove evidence. ↗
- →Confirm HTTP/HTTPS services are running by checking for httpd processes; presence of both httpd-gk and httpd confirms the attack surface is exposed. ↗
- →Monitor for J-Web session token theft — if J-Web is active and an administrator is logged in, an attacker exploiting this vulnerability could obtain admin-level session tokens. ↗
- ·Vulnerability only affects devices with HTTP/HTTPS services enabled; devices with these services disabled are not affected. ↗
- ·On Junos OS 19.3R1 and above, an unauthenticated attacker can read the configuration file (world-readable), elevating the confidentiality impact significantly. ↗
- ·Command injection impact is limited because the HTTP service runs as the low-privilege user 'nobody'. ↗
- ·Confirmed in-the-wild exploitation reported to Juniper SIRT prior to advisory publication. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vulncheck8.8HIGH
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-g762-xhjq-x42p: A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirec
ghsa_unreviewed·2022-05-24
CVE-2020-1631 [MEDIUM] CWE-22 GHSA-g762-xhjq-x42p: A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirec
A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal. Using this vulnerability, an attacker may be able to inject commands into the httpd.log, read files with 'world' readable permission file or obtain J-Web session tokens. In the case of command injection, as the HTTP service runs as user 'nobody', the impact of this command injection is limited. (CVSS score 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) In the case of reading files with 'world' readable permission, in Junos OS 19.3R1 and above, the unauthenticated attacker would be able to read the configu
VulnCheck
Juniper Junos OS Path Traversal Vulnerability
vulncheck·2020·CVSS 8.8
CVE-2020-1631 [HIGH] CWE-22 Juniper Junos OS Path Traversal Vulnerability
Juniper Junos OS Path Traversal Vulnerability
A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform remote code execution.
Affected: Juniper Junos OS
Required Action: Apply updates per vendor instructions.
Exploitation References: https://www.cve.org/CVERecord?id=CVE-2020-1631; https://cisa.gov/news-events/cybersecurity-advisories/aa20-283a; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Remediation Due: 2022-04-15
CISA
Juniper Junos OS Path Traversal Vulnerability
cisa·2022-03-25·CVSS 9.8
CVE-2020-1631 [CRITICAL] CWE-22 Juniper Junos OS Path Traversal Vulnerability
Vulnerability: Juniper Junos OS Path Traversal Vulnerability
Affected: Juniper Junos OS
A path traversal vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform remote code execution.
Required Action: Apply updates per vendor instructions.
Notes: https://nvd.nist.gov/vuln/detail/CVE-2020-1631
Remediation Due Date: 2022-04-15
Juniper
CVE-2020-1631: A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirec
vendor_juniper·2020-05-04·CVSS 8.8
CVE-2020-1631 [HIGH] CWE-22 CVE-2020-1631: A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirec
CVE-2020-1631: A vulnerability in the HTTP/HTTPS service used by J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal. Using this vulnerability, an attacker may be able to inject commands into the httpd.log, read files with 'world' readable permission file or obtain J-Web session tokens. In the case of command injection, as the HTTP service runs as user 'nobody', the impact of this command injection is limited. (CVSS score 5.3, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) In the case of reading files with 'world' readable permission, in Junos OS 19.3R1 and above, the unauthenticated attacker would be able to r
No detection rules found.
No public exploits indexed.
Tenable
CVE-2020-1472: Advanced Persistent Threat Actors Use Zerologon Vulnerability In Exploit Chain with Unpatched Vulnerabilities
blogs_tenable·2020-10-12·CVSS 5.5
[MEDIUM] CVE-2020-1472: Advanced Persistent Threat Actors Use Zerologon Vulnerability In Exploit Chain with Unpatched Vulnerabilities
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bugzilla
CVE-2018-7263 libmad: Double-free in the mad_decoder_run() function
bugzilla·2018-02-21·CVSS 6.5
CVE-2018-7263 [MEDIUM] CVE-2018-7263 libmad: Double-free in the mad_decoder_run() function
CVE-2018-7263 libmad: Double-free in the mad_decoder_run() function
The mad_decoder_run() function in decoder.c in Underbit libmad through 0.15.1b allows attackers to cause a denial of service (SIGABRT because of double free or corruption) or possibly have unspecified other impact via a crafted file. NOTE: this may overlap CVE-2017-11552.
References:
https://bugzilla.suse.com/show_bug.cgi?id=1081784
Discussion:
Created libmad tracking bugs for this issue:
Affects: epel-all [bug 1477498]
Affects: fedora-all [bug 1477499]
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2020:1631 https://access.redhat.com/errata/RHSA-2020:1631
---
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
2020-05-04
Published
2022-03-25
Added to CISA KEV
Exploited in the wild