CVE-2024-21620

published 2024-01-25

CVE-2024-21620: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and…

Priority P1 81 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

ITW VulnCheck KEV

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an attacker to construct a URL that when visited by another user enables the attacker to execute commands with the target's permissions, including an administrator.

A specific invocation of the emit_debug_note method in webauth_operation.php will echo back the data it receives.

This issue affects Juniper Networks Junos OS on SRX Series and EX Series:
* All versions earlier than 20.4R3-S10;
* 21.2 versions earlier than 21.2R3-S8;
* 21.4 versions earlier than 21.4R3-S6;
* 22.1 versions earlier than 22.1R3-S5;
* 22.2 versions earlier than 22.2R3-S3;
* 22.3 versions earlier than 22.3R3-S2;
* 22.4 versions earlier than 22.4R3-S1;
* 23.2 versions earlier than 23.2R2;
* 23.4 versions earlier than 23.4R2.

Affected

23 ranges

Vendor	Product	Version range	Fixed in
juniper	ex_series	—	—
juniper	j-web	—	—
juniper	junos	< 20.4	20.4
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos	—	—
juniper	junos_os	—	—
juniper	srx_series	—	—
juniper_networks	junos_os	< 20.4R3-S10	20.4R3-S10
juniper_networks	junos_os	>= 21.2 < 21.2R3-S8	21.2R3-S8
juniper_networks	junos_os	>= 21.4 < 21.4R3-S6	21.4R3-S6
juniper_networks	junos_os	>= 22.1 < 22.1R3-S5	22.1R3-S5
juniper_networks	junos_os	>= 22.2 < 22.2R3-S3	22.2R3-S3
juniper_networks	junos_os	>= 22.3 < 22.3R3-S2	22.3R3-S2
juniper_networks	junos_os	>= 22.4 < 22.4R3-S1	22.4R3-S1
juniper_networks	junos_os	>= 23.2 < 23.2R2	23.2R2
juniper_networks	junos_os	>= 23.4 < 23.4R2	23.4R2

Detection & IOCs extracted from sources · hover to see the quote

path webauth_operation.php↗

• → Monitor HTTP requests targeting webauth_operation.php in J-Web for unexpected or unsanitized parameters passed to the emit_debug_note method, which reflects input back to the client — a hallmark of reflected XSS exploitation. ↗
• → Alert on crafted URLs referencing webauth_operation.php being distributed or visited, particularly those containing script injection payloads, as the attack vector requires a victim to visit an attacker-constructed URL. ↗

• · Vulnerability is only exploitable on Juniper SRX Series and EX Series devices running Junos OS with J-Web enabled. Devices not exposing J-Web are not at risk. ↗
• · All Junos OS versions prior to 20.4R3-S10, and specific 21.x–23.x branches prior to their respective fixed releases, are affected. Ensure patching covers all listed version ranges. ↗

CVSS provenance

nvd v3.1 6.1 MEDIUM CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

vulncheck 8.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79