CVE-2022-22242
published 2022-10-18CVE-2022-22242: A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scripts…
PriorityP180medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
2.47%
82.7th percentile
A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scripts reflected off of J-Web to the victim's browser in the context of their session within J-Web. This issue affects Juniper Networks Junos OS all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2; 22.1 versions prior to 22.1R2.
Affected
29 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | j-web | — | — |
| juniper | junos | < 19.1 | 19.1 |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos_os | — | — |
| juniper_networks | junos_os | >= 19.2 < 19.2R3-S6 | 19.2R3-S6 |
| juniper_networks | junos_os | >= 19.3 < 19.3R3-S7 | 19.3R3-S7 |
| juniper_networks | junos_os | >= 19.4 < 19.4R2-S7, 19.4R3-S8 | 19.4R2-S7, 19.4R3-S8 |
| juniper_networks | junos_os | >= 20.1 < 20.1R3-S5 | 20.1R3-S5 |
| juniper_networks | junos_os | >= 20.2 < 20.2R3-S5 | 20.2R3-S5 |
| juniper_networks | junos_os | >= 20.3 < 20.3R3-S5 | 20.3R3-S5 |
| juniper_networks | junos_os | >= 20.4 < 20.4R3-S4 | 20.4R3-S4 |
| juniper_networks | junos_os | >= 21.1 < 21.1R3-S4 | 21.1R3-S4 |
| juniper_networks | junos_os | >= 21.2 < 21.2R3-S1 | 21.2R3-S1 |
Detection & IOCsextracted from sources · hover to see the quote
url/error.php?SERVER_NAME=alert(document.domain)
path/error.php
snort
alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Potential Juniper Reflected XSS Attempt (CVE-2022-22242)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/error.php?"; startswith; content:"|3d 3c|script|3e|alert|28|0|29 3c 2f|script|3e|"; distance:0; fast_pattern; reference:url,octagon.net/blog/2022/10/28/juniper-sslvpn-junos-rce-and-multiple-vulnerabilities/; reference:cve,2022-22242; classtype:trojan-activity; sid:2039598; rev:1; metadata:attack_target Server, created_at 2022_10_28, cve CVE_2022_22242, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2022_10_28;)
bytes
|3d 3c|script|3e|alert|28|0|29 3c 2f|script|3e|
- →The vulnerable endpoint is /error.php with the SERVER_NAME parameter being reflected unsanitized into the response body. Probe for XSS payload reflection in the HTTP response body alongside the string 'The requested resource is not authorized to view'.
- →Shodan/FOFA/Google dork for exposed J-Web instances: search for title 'Juniper Web Device Manager' to identify attack surface.
- →The Emerging Threats Snort rule (SID 2039598) fires on GET requests to /error.php? containing a URL-encoded <script>alert(0)</script> payload (hex: 3d 3c 73 63 72 69 70 74 3e ...). Deploy with SSL inspection (SSLDecrypt) at the perimeter.
- →The vulnerability is unauthenticated and reflected — no session required. Monitor for GET requests to /error.php? with script-injection patterns in query parameters from external IP ranges.
- ·The XSS is reflected (not stored), meaning exploitation requires the victim to click a crafted link. The attacker does not need to be authenticated, but the victim must have an active J-Web session for session-cookie theft to succeed. ↗
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
vulncheck6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qq74-54g4-qw47: A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scr
ghsa_unreviewed·2022-10-18
CVE-2022-22242 [MEDIUM] CWE-79 GHSA-qq74-54g4-qw47: A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scr
A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scripts reflected off of J-Web to the victim's browser in the context of their session within J-Web. This issue affects Juniper Networks Junos OS all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2; 22.1 versions prior to 22.1R2.
VulnCheck
Juniper Junos OS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulncheck·2022·CVSS 6.1
CVE-2022-22242 [MEDIUM] Juniper Junos OS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Juniper Junos OS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scripts reflected off of J-Web to the victim's browser in the context of their session within J-Web. This issue affects Juniper Networks Junos OS all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to
Juniper
CVE-2022-22242: A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scr
vendor_juniper·2022-10-18·CVSS 6.1
CVE-2022-22242 [MEDIUM] CWE-79 CVE-2022-22242: A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scr
CVE-2022-22242: A Cross-site Scripting (XSS) vulnerability in the J-Web component of Juniper Networks Junos OS allows an unauthenticated attacker to run malicious scripts reflected off of J-Web to the victim's browser in the context of their session within J-Web. This issue affects Juniper Networks Junos OS all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 21.3R3; 21.4 versions prior to 21.4R2; 22.1 versions prior to 22.1R2.
Suricata
ET MALWARE Potential Juniper Reflected XSS Attempt (CVE-2022-22242)
suricata·2022-10-28·CVSS 6.1
CVE-2022-22242 [MEDIUM] ET MALWARE Potential Juniper Reflected XSS Attempt (CVE-2022-22242)
ET MALWARE Potential Juniper Reflected XSS Attempt (CVE-2022-22242)
Rule: alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET MALWARE Potential Juniper Reflected XSS Attempt (CVE-2022-22242)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/error.php?"; startswith; content:"|3d 3c|script|3e|alert|28|0|29 3c 2f|script|3e|"; distance:0; fast_pattern; reference:url,octagon.net/blog/2022/10/28/juniper-sslvpn-junos-rce-and-multiple-vulnerabilities/; reference:cve,2022-22242; classtype:trojan-activity; sid:2039598; rev:1; metadata:attack_target Server, created_at 2022_10_28, cve CVE_2022_22242, deployment Perimeter, deployment SSLDecrypt, performance_impact Low, confidence High, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 20
Nuclei
Juniper Web Device Manager - Cross-Site Scripting
nuclei·CVSS 6.1
CVE-2022-22242 [MEDIUM] Juniper Web Device Manager - Cross-Site Scripting
Juniper Web Device Manager - Cross-Site Scripting
Juniper Web Device Manager (J-Web) in Junos OS contains a cross-site scripting vulnerability. This can allow an unauthenticated attacker to run malicious scripts reflected off J-Web to the victim's browser in the context of their session within J-Web, which can allow the attacker to steal cookie-based authentication credentials and launch other attacks. This issue affects all versions prior to 19.1R3-S9; 19.2 versions prior to 19.2R3-S6; 19.3 versions prior to 19.3R3-S7; 19.4 versions prior to 19.4R2-S7, 19.4R3-S8; 20.1 versions prior to 20.1R3-S5; 20.2 versions prior to 20.2R3-S5; 20.3 versions prior to 20.3R3-S5; 20.4 versions prior to 20.4R3-S4; 21.1 versions prior to 21.1R3-S4; 21.2 versions prior to 21.2R3-S1; 21.3 versions prior to 2
2022-10-18
Published
Exploited in the wild