CVE-2024-21620: Juniper Junos J-Web XSS Vulnerability

CVE-2024-21620 Overview

CVE-2024-21620 is a reflected cross-site scripting (XSS) vulnerability [CWE-79] in the J-Web interface of Juniper Networks Junos OS, affecting SRX Series firewalls and EX Series switches. The flaw resides in the emit_debug_note method within webauth_operation.php, which echoes attacker-supplied input back to the browser without proper neutralization. An attacker who tricks an authenticated administrator into visiting a crafted URL can execute arbitrary commands with that administrator's privileges on the device. Juniper disclosed the issue in security advisory JSA76390.

Critical Impact
Successful exploitation allows an attacker to hijack an administrator's authenticated session on an SRX firewall or EX switch and execute Junos OS commands with full administrative permissions.

Affected Products

Juniper Networks Junos OS on SRX Series (SRX100 through SRX5800, including SRX1500, SRX1600, SRX2300, SRX4100, SRX4200, SRX4300, SRX4600, SRX4700)
Juniper Networks Junos OS on EX Series (EX2200 through EX9253, including EX3400, EX4100, EX4300, EX4400, EX4600, EX4650)
All Junos OS versions earlier than 20.4R3-S10, 21.2R3-S8, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3-S1, 23.2R2, and 23.4R2

Discovery Timeline

2024-01-25 - CVE-2024-21620 published to NVD via Juniper advisory JSA76390
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-21620

Vulnerability Analysis

The vulnerability is a reflected XSS flaw in the J-Web management interface, the HTTP-based administrative console for Junos OS. The emit_debug_note function in webauth_operation.php writes request-supplied values directly into the HTTP response body without HTML-encoding or sanitization. When an administrator loads a crafted URL that targets this endpoint, the browser renders attacker-controlled JavaScript in the context of the authenticated J-Web session.

Because J-Web issues configuration and operational commands on behalf of the logged-in user, injected JavaScript can issue the same requests programmatically. An attacker can therefore invoke CLI operations, modify configuration, or exfiltrate session artifacts with administrator permissions. User interaction is required, which aligns with typical phishing or watering-hole delivery of the malicious link.

Root Cause

The root cause is improper neutralization of input during web page generation in webauth_operation.php. The emit_debug_note method reflects user-controlled parameters into the response without output encoding, violating secure output handling for the HTML context.

Attack Vector

The attack is network-based and requires an authenticated administrator (or any J-Web user) to click a crafted link pointing to the vulnerable endpoint on the target device. The payload is reflected in the response page, and the injected script executes in the victim's browser, inheriting the victim's J-Web session rights. No credentials are required by the attacker; the privilege level inherited matches the victim's role, including full administrator.

// Conceptual payload pattern (do not use)
// Attacker-supplied input reaches emit_debug_note() in
// /webauth_operation.php and is reflected unescaped into HTML.
GET /webauth_operation.php?<reflected-parameter>=<script-payload> HTTP/1.1
Host: <junos-device>

Detection Methods for CVE-2024-21620

Indicators of Compromise

HTTP(S) requests to /webauth_operation.php on J-Web containing script tags, event handlers (for example onerror=, onload=), or encoded JavaScript in query parameters
Outbound HTTP requests from administrator workstations to unfamiliar domains immediately after visiting a J-Web URL
Unexpected configuration commits, user additions, or RPC calls recorded in Junos audit logs under an administrator account

Detection Strategies

Inspect J-Web web server logs for requests to webauth_operation.php with parameter values containing <, >, script, javascript:, or URL-encoded equivalents (%3C, %3E)
Correlate administrator browser activity with Junos commit and RPC logs to identify configuration changes that follow suspicious link clicks
Deploy WAF or IDS signatures that flag reflected XSS patterns targeting Juniper J-Web endpoints

Monitoring Recommendations

Forward Junos interactive-commands and authorization syslog streams to a centralized logging platform for correlation with web-tier events
Alert on new administrative sessions originating from unexpected source IPs or user agents
Review HTTP referrer headers on J-Web traffic to detect administrators arriving from external, non-corporate pages

How to Mitigate CVE-2024-21620

Immediate Actions Required

Upgrade Junos OS to a fixed release: 20.4R3-S10, 21.2R3-S8, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3-S1, 23.2R2, 23.4R2, or later
Restrict J-Web access to a dedicated management network and trusted administrator source addresses using firewall filters
Instruct administrators to log out of J-Web when not actively managing devices and to avoid clicking links to Junos endpoints from untrusted sources

Patch Information

Juniper Networks published fixes in security advisory JSA76390. Apply the first fixed release for your Junos train as listed above. See the Juniper Security Advisory JSA76390 for the complete remediation matrix and release notes.

Workarounds

Disable J-Web entirely where CLI or NETCONF management is sufficient: delete system services web-management
If J-Web is required, limit access via set system services web-management https combined with a management-plane firewall filter that permits only trusted administrator subnets
Enforce browser isolation or separate administrative browser profiles so that session cookies are not shared with general web browsing

bash

# Example Junos configuration to disable J-Web
configure
delete system services web-management http
delete system services web-management https
commit and-quit