CVE-2024-39565: Juniper Junos OS J-Web RCE Vulnerability

CVE-2024-39565 Overview

CVE-2024-39565 is an Improper Neutralization of Data within XPath Expressions ('XPath Injection') vulnerability affecting J-Web, the web-based management interface shipped with Juniper Networks Junos OS. This vulnerability allows an unauthenticated, network-based attacker to execute remote commands on the target device by exploiting improper input validation in XPath query processing.

When an administrator is logged into a J-Web session or has previously logged in and subsequently logged out, an attacker can arbitrarily execute commands on the target device using the other user's credentials. In the worst case scenario, the attacker can gain full control over the affected Juniper device, potentially compromising network infrastructure security.

Critical Impact

This XPath Injection vulnerability enables unauthenticated remote command execution with the potential for complete device takeover, affecting multiple versions of Junos OS across enterprise network infrastructure.

Affected Products

• Juniper Networks Junos OS - All versions before 21.2R3-S8
• Juniper Networks Junos OS - from 21.4 before 21.4R3-S7, from 22.2 before 22.2R3-S4, from 22.3 before 22.3R3-S3
• Juniper Networks Junos OS - from 22.4 before 22.4R3-S2, from 23.2 before 23.2R2, from 23.4 before 23.4R1-S1 or 23.4R2

Discovery Timeline

• 2024-07-10 - CVE-2024-39565 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-39565

Vulnerability Analysis

This XPath Injection vulnerability (CWE-643) resides in the J-Web management interface of Juniper Networks Junos OS. The vulnerability occurs when user-supplied input is improperly neutralized before being incorporated into XPath expressions used by the application. XPath Injection is particularly dangerous in web management interfaces as it can be leveraged to bypass authentication mechanisms, extract sensitive configuration data, or as demonstrated in this case, execute arbitrary commands on the underlying system.

The attack requires network access to the J-Web interface and depends on an administrator having an active or recently terminated session. The attacker does not need any privileges or authentication to initiate the attack, though user interaction in the form of an active or recent admin session is required for successful exploitation. Upon successful exploitation, an attacker can execute commands with the credentials of the logged-in administrator, potentially achieving full control of the network device.

Root Cause

The root cause of CVE-2024-39565 is improper input validation and neutralization in the J-Web component when processing user-supplied data that gets incorporated into XPath expressions. The application fails to adequately sanitize or escape special characters and XPath syntax elements before constructing dynamic XPath queries, allowing attackers to inject malicious XPath constructs that alter the intended query logic.

Attack Vector

The attack vector for this vulnerability is network-based, targeting the J-Web management interface exposed on Juniper devices running Junos OS. An attacker positioned on the network with access to the J-Web interface can craft malicious requests containing XPath injection payloads.

The attack exploits session handling in J-Web where an administrator's credentials or session context can be leveraged by the attacker. When the malicious XPath expression is processed by the vulnerable component, it enables the attacker to execute arbitrary commands on the device. The exploitation complexity is high as it requires precise timing related to administrator sessions and specific conditions to be met.

The vulnerability allows command execution without authentication, making any J-Web instance accessible from untrusted networks particularly at risk. Organizations exposing J-Web to the internet or insufficiently segmented network zones face the greatest exposure to this threat.

Detection Methods for CVE-2024-39565

Indicators of Compromise

• Unexpected or anomalous requests to J-Web management interface containing XPath syntax characters such as single quotes, double quotes, brackets, or XPath functions
• Unusual command execution logs on Juniper devices correlated with J-Web access times
• Authentication logs showing administrator actions that do not correspond with legitimate administrator activity

Detection Strategies

• Monitor J-Web access logs for requests containing potential XPath injection payloads including special characters and XPath keywords
• Implement web application firewall (WAF) rules to detect and block XPath injection attempts targeting J-Web endpoints
• Deploy network intrusion detection signatures for XPath injection patterns in HTTP traffic destined for J-Web ports

Monitoring Recommendations

• Enable comprehensive logging on J-Web interfaces and forward logs to SIEM for correlation and analysis
• Establish baseline behavior for J-Web administrative access and alert on deviations such as unusual source IPs or access times
• Monitor system command execution logs on Juniper devices for commands that may indicate unauthorized access or exploitation

How to Mitigate CVE-2024-39565

Immediate Actions Required

• Upgrade Junos OS to a fixed version immediately: 21.2R3-S8, 21.4R3-S7, 22.2R3-S4, 22.3R3-S3, 22.4R3-S2, 23.2R2, 23.4R1-S1, or 23.4R2 or later
• Restrict J-Web access to trusted management networks only using firewall rules or access control lists
• Disable J-Web if not required for device management, using CLI-based management instead
• Review and audit recent J-Web access logs for signs of exploitation attempts

Patch Information

Juniper Networks has released security patches addressing this vulnerability across multiple Junos OS release trains. Detailed patch information and download links are available through the Juniper Security Advisory JSA83023. Organizations should obtain the appropriate patched version for their deployment from the Juniper Support Downloads Portal.

Workarounds

• Disable J-Web entirely on affected devices if the web management interface is not operationally required
• Implement strict network segmentation to ensure J-Web is only accessible from dedicated management networks with strong access controls
• Use jump hosts or bastion servers for administrative access, reducing direct exposure of J-Web interfaces
• Enable multi-factor authentication for management access where supported and enforce strong session management policies

# Disable J-Web on Juniper device (CLI)
set system services web-management http interface none
set system services web-management https interface none
commit