CVE-2020-1631: Juniper Junos Path Traversal Vulnerability

CVE-2020-1631 Overview

A critical vulnerability exists in the HTTP/HTTPS service used by multiple Juniper Junos OS components including J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP). This vulnerability allows an unauthenticated attacker to perform local file inclusion (LFI) or path traversal attacks against affected devices.

The vulnerability enables attackers to inject commands into the httpd.log file, read files with world-readable permissions, and potentially obtain J-Web session tokens. In environments where J-Web is enabled and administrators are actively logged in, an attacker could gain administrator-level access to the J-Web management interface. Juniper SIRT has confirmed at least one report of this vulnerability being exploited in the wild.

Critical Impact

This vulnerability is actively exploited and listed in CISA's Known Exploited Vulnerabilities catalog. Attackers can read configuration files, steal session tokens, and potentially gain full administrative access to Juniper devices.

Affected Products

• Juniper Junos OS 12.3 versions prior to 12.3R12-S16
• Juniper Junos OS 12.3X48 versions prior to 12.3X48-D101, 12.3X48-D105
• Juniper Junos OS 14.1X53 versions prior to 14.1X53-D54
• Juniper Junos OS 15.1 versions prior to 15.1R7-S7
• Juniper Junos OS 15.1X49 versions prior to 15.1X49-D211, 15.1X49-D220
• Juniper Junos OS 16.1 versions prior to 16.1R7-S8
• Juniper Junos OS 17.2 versions prior to 17.2R3-S4
• Juniper Junos OS 17.3 versions prior to 17.3R3-S8
• Juniper Junos OS 17.4 versions prior to 17.4R2-S11, 17.4R3-S2
• Juniper Junos OS 18.1 versions prior to 18.1R3-S10
• Juniper Junos OS 18.2 versions prior to 18.2R2-S7, 18.2R3-S4
• Juniper Junos OS 18.3 versions prior to 18.3R2-S4, 18.3R3-S2
• Juniper Junos OS 18.4 versions prior to 18.4R1-S7, 18.4R3-S2
• Juniper Junos OS 19.1 versions prior to 19.1R1-S5, 19.1R3-S1
• Juniper Junos OS 19.2 versions prior to 19.2R2
• Juniper Junos OS 19.3 versions prior to 19.3R2-S3, 19.3R3
• Juniper Junos OS 19.4 versions prior to 19.4R1-S2, 19.4R2
• Juniper Junos OS 20.1 versions prior to 20.1R1-S1, 20.1R2

Discovery Timeline

• May 4, 2020 - CVE-2020-1631 published to NVD
• October 24, 2025 - Last updated in NVD database

Technical Details for CVE-2020-1631

Vulnerability Analysis

This vulnerability resides in the HTTP/HTTPS service component of Juniper Junos OS that powers multiple web-facing services. The flaw is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal.

The impact varies depending on the deployment configuration:

When J-Web is disabled but HTTP/HTTPS services are enabled: Attackers can read world-readable files on the system. On Junos OS 19.3R1 and above, this includes the device configuration file, exposing sensitive network infrastructure details.

When J-Web is enabled: The most severe impact occurs when an administrator is actively logged into J-Web. Attackers can steal J-Web session tokens and hijack authenticated sessions, gaining full administrative access to the device.

Command Injection: Attackers can inject commands into the httpd.log file. However, since the HTTP service runs as the unprivileged nobody user, the immediate impact of command injection is limited, though it may serve as a stepping stone for further attacks.

Root Cause

The vulnerability stems from insufficient input validation in the HTTP/HTTPS service request handling. The affected services fail to properly sanitize user-supplied input, allowing path traversal sequences (such as ../) to escape the intended directory and access arbitrary files on the filesystem. This improper validation enables both local file inclusion and command injection through log file manipulation.

Attack Vector

This vulnerability is exploitable remotely over the network without authentication. An attacker can craft malicious HTTP/HTTPS requests containing path traversal sequences to access files outside the web root directory. The attack can be executed against any Juniper device with HTTP/HTTPS services exposed, making internet-facing devices particularly at risk.

The attack methodology involves sending specially crafted requests that include path traversal characters to read sensitive files or inject malicious content into log files. Successful exploitation can lead to configuration disclosure, session hijacking, and potentially full device compromise when administrator sessions are active.

Detection Methods for CVE-2020-1631

Indicators of Compromise

• Suspicious entries in /var/log/httpd.log containing the string patterns =*;*& or *%3b*& indicating command injection attempts
• Unexpected access to configuration files or world-readable system files through HTTP/HTTPS requests
• Anomalous J-Web session activity, particularly sessions originating from unexpected IP addresses
• Evidence of log tampering or truncation in httpd.log and rotated logs (httpd.log.0.gz, httpd.log.1.gz)

Detection Strategies

• Monitor HTTP/HTTPS request logs for path traversal sequences such as ../, ..%2f, or URL-encoded variants
• Implement network intrusion detection rules to identify malicious requests targeting J-Web and related services
• Enable enhanced logging on Juniper devices and forward logs to a centralized SIEM for analysis
• Deploy web application firewall (WAF) rules to block path traversal patterns in requests to Juniper management interfaces

Monitoring Recommendations

• Regularly review httpd.log using the Juniper command: show log httpd.log | match "=*;*&|=*%3b*&"
• Also examine rotated logs: show log httpd.log.0.gz | match "=*;*&|=*%3b*&" and show log httpd.log.1.gz | match "=*;*&|=*%3b*&"
• Monitor for unauthorized configuration changes or unexpected administrative access
• Track session token usage and correlate with expected administrator login activity

How to Mitigate CVE-2020-1631

Immediate Actions Required

• Disable HTTP/HTTPS services on all Juniper devices where they are not required for operational purposes
• If J-Web is not in use, disable it immediately to reduce the attack surface
• Restrict access to J-Web and HTTP/HTTPS services to trusted management networks only using firewall rules or access control lists
• Review active J-Web sessions and invalidate any suspicious or unauthorized sessions
• Audit httpd.log files for indicators of compromise and investigate any suspicious entries

Patch Information

Juniper Networks has released security patches to address this vulnerability. Administrators should upgrade to the following fixed versions as appropriate for their deployment:

• Junos OS 12.3R12-S16 or later
• Junos OS 12.3X48-D101, 12.3X48-D105 or later
• Junos OS 14.1X53-D54 or later
• Junos OS 15.1R7-S7 or later
• Junos OS 15.1X49-D211, 15.1X49-D220 or later
• Junos OS 16.1R7-S8 or later
• Junos OS 17.2R3-S4 or later
• Junos OS 17.3R3-S8 or later
• Junos OS 17.4R2-S11, 17.4R3-S2 or later
• Junos OS 18.1R3-S10 or later
• Junos OS 18.2R2-S7, 18.2R3-S4 or later
• Junos OS 18.3R2-S4, 18.3R3-S2 or later
• Junos OS 18.4R1-S7, 18.4R3-S2 or later
• Junos OS 19.1R1-S5, 19.1R3-S1 or later
• Junos OS 19.2R2 or later
• Junos OS 19.3R2-S3, 19.3R3 or later
• Junos OS 19.4R1-S2, 19.4R2 or later
• Junos OS 20.1R1-S1, 20.1R2 or later

For complete patch details, refer to the Juniper Security Advisory JSA11021.

Workarounds

• Completely disable HTTP/HTTPS services if not required by running: delete system services web-management
• If HTTP/HTTPS services must remain enabled, use firewall filters to restrict access to trusted source IP addresses only
• Implement network segmentation to isolate Juniper management interfaces from untrusted networks
• Consider using alternative management methods such as SSH/CLI access instead of J-Web until patching is complete

# Check if HTTP/HTTPS services are running on your device
show system processes | match http

# If output shows httpd processes, consider disabling web management
# Configuration to disable web management services
delete system services web-management

# Apply firewall filter to restrict J-Web access to trusted networks only
set firewall filter PROTECT-JWEB term ALLOW-MGMT from source-prefix-list TRUSTED-MGMT-NETS
set firewall filter PROTECT-JWEB term ALLOW-MGMT then accept
set firewall filter PROTECT-JWEB term DENY-ALL then discard