Multiple vulnerabilities in Junos OS J-Web
| Risk | Critical |
| Patch available | YES |
| Number of vulnerabilities | 5 |
| CVE-ID | CVE-2023-0567 CVE-2023-0662 CVE-2023-3823 CVE-2023-3824 CVE-2023-0568 |
| CWE-ID | CWE-330 CWE-20 CWE-611 CWE-119 CWE-787 |
| Exploitation vector | Network |
| Public exploit | Vulnerability #4 is being exploited in the wild. |
| Vulnerable software |
Juniper Junos OS Operating systems & Components / Operating system |
| Vendor | Juniper Networks, Inc. |
Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
1) Use of insufficiently random values
EUVDB-ID: #VU72166
Risk: Medium
CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-0567
CWE-ID:
CWE-330 - Use of Insufficiently Random Values
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass authentication.
The vulnerability exists due to an error within the Password_verify() function, which always returns true with some hashes. A remote attacker can bypass authentication process and gain unauthorized access to the application.
Install update from vendor's website.
Vulnerable software versionsJuniper Junos OS: 21.4R1-S1 - 24.2R1-S1
CPE2.3- cpe:2.3:o:juniper_networks:juniper_junos_os:21.4R3-S7.9:*:*:*:*:*:*:*
- cpe:2.3:o:juniper_networks:juniper_junos_os:22.1R3-S5.3:*:*:*:*:*:*:*
- cpe:2.3:o:juniper_networks:juniper_junos_os:22.2R3-S3:*:*:*:*:*:*:*
- cpe:2.3:o:juniper_networks:juniper_junos_os:22.3R3-S2:*:*:*:*:*:*:*
- cpe:2.3:o:juniper_networks:juniper_junos_os:22.4R3-S1:*:*:*:*:*:*:*
- cpe:2.3:o:juniper_networks:juniper_junos_os:23.2R2-S1:*:*:*:*:*:*:*
- cpe:2.3:o:juniper_networks:juniper_junos_os:23.4R1-S1:*:*:*:*:*:*:*
- cpe:2.3:o:juniper_networks:juniper_junos_os:23.4R2-S3:*:*:*:*:*:*:*
- cpe:2.3:o:juniper_networks:juniper_junos_os:24.2R1-S1:*:*:*:*:*:*:*
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Input validation error
EUVDB-ID: #VU72165
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-0662
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when parsing multipart request body. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.
MitigationInstall update from vendor's website.
Vulnerable software versionsJuniper Junos OS: 21.4R1-S1 - 24.2R1-S1
CPE2.3Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) XML External Entity injection
EUVDB-ID: #VU78977
Risk: High
CVSSv3.1: 7.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-3823
CWE-ID:
CWE-611 - Improper Restriction of XML External Entity Reference ('XXE')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to gain access to sensitive information.
The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.
Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.
MitigationInstall update from vendor's website.
Vulnerable software versionsJuniper Junos OS: 21.4R1-S1 - 24.2R1-S1
CPE2.3Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Buffer overflow
EUVDB-ID: #VU78978
Risk: Critical
CVSSv3.1: 7.4 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L/E:H/RL:O/RC:C]
CVE-ID: CVE-2023-3824
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the phar_dir_read() function. A remote attacker can force the application to open a specially crafted .phar archive, trigger memory corruption and execute arbitrary code on the target system.
MitigationInstall update from vendor's website.
Vulnerable software versionsJuniper Junos OS: 21.4R1-S1 - 24.2R1-S1
CPE2.3Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
5) Out-of-bounds write
EUVDB-ID: #VU72167
Risk: Medium
CVSSv3.1: 7.1 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2023-0568
CWE-ID:
CWE-787 - Out-of-bounds write
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a boundary error when processing untrusted input in fopen_wrappers.c. A remote attacker can pass a specially crafted filename to the affected application, trigger a one-byte buffer overflow and crash the application or potentially execute arbitrary code.
MitigationInstall update from vendor's website.
Vulnerable software versionsJuniper Junos OS: 21.4R1-S1 - 24.2R1-S1
CPE2.3Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
