CVE-2025-52987: Paragon Automation Clickjacking Flaw

CVE-2025-52987 Overview

CVE-2025-52987 is a clickjacking vulnerability in the web portal of Juniper Networks Paragon Automation, affecting the Pathfinder, Planner, and Insights components. The application fails to set the X-Frame-Options and X-Content-Type-Options HTTP response headers. This omission allows an attacker to embed the portal within a malicious frame and trick authenticated users into performing unintended actions. The issue affects all versions of Paragon Automation before 24.1.1 and maps to [CWE-1021] (Improper Restriction of Rendered UI Layers or Frames).

Critical Impact
Authenticated administrators can be tricked into performing state-changing actions on Paragon Automation through a framed portal controlled by an attacker.

Affected Products

Juniper Networks Paragon Automation Pathfinder (all versions before 24.1.1)
Juniper Networks Paragon Automation Planner (all versions before 24.1.1)
Juniper Networks Paragon Automation Insights (all versions before 24.1.1)

Discovery Timeline

2026-01-15 - CVE-2025-52987 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-52987

Vulnerability Analysis

The Paragon Automation web portal serves HTTP responses without the X-Frame-Options header and without a Content Security Policy frame-ancestors directive. Browsers will therefore render the portal inside an iframe on any origin. An attacker hosting a malicious page can layer a transparent frame of the Paragon UI over decoy content and capture user clicks. The missing X-Content-Type-Options: nosniff header further permits browser MIME sniffing, which can expand the impact when combined with content-type confusion. Successful exploitation requires an authenticated user session and user interaction, and the impact is limited to the browser-side integrity of the interface rather than the underlying host.

Root Cause

The root cause is a missing security header configuration in the Paragon Automation HTTP response pipeline. Without X-Frame-Options: DENY or SAMEORIGIN, or an equivalent CSP frame-ancestors 'self' directive, the browser has no instruction to block cross-origin framing. The absence of X-Content-Type-Options: nosniff compounds the issue by allowing MIME type inference.

Attack Vector

An attacker crafts an external web page that loads the Paragon Automation portal in an invisible iframe. The attacker aligns UI elements such as buttons or toggles with visible decoy elements on the outer page. When a signed-in operator visits the malicious page and clicks the decoy, the click is delivered to the framed Paragon interface instead. This can trigger configuration changes, workflow executions, or other administrative actions in Pathfinder, Planner, or Insights. No verified public exploit code is available for CVE-2025-52987. Refer to the Juniper Security Advisory JSA103145 for vendor technical details.

Detection Methods for CVE-2025-52987

Indicators of Compromise

Unexpected configuration changes in Pathfinder, Planner, or Insights performed by authenticated users during normal browsing sessions.
HTTP referer headers in Paragon access logs pointing to unfamiliar external origins.
User reports of unexplained UI behavior or actions they did not intend to perform.

Detection Strategies

Inspect HTTP responses from the Paragon Automation web portal for the presence of X-Frame-Options and X-Content-Type-Options headers.
Correlate portal action logs with browser referer and user-agent data to identify actions initiated from external referrers.
Deploy browser-side alerting for framing violations using a Content-Security-Policy-Report-Only header with a frame-ancestors directive.

Monitoring Recommendations

Enable and forward Paragon Automation audit logs to a centralized SIEM for review of administrative actions.
Monitor authentication sessions for actions occurring shortly after users visit untrusted external sites.
Establish a baseline of legitimate configuration change frequency and alert on statistical deviations.

How to Mitigate CVE-2025-52987

Immediate Actions Required

Upgrade Paragon Automation Pathfinder, Planner, and Insights to version 24.1.1 or later.
Restrict access to the Paragon Automation web portal to trusted management networks only.
Instruct administrators to use a dedicated browser profile for Paragon and avoid other browsing during active sessions.

Patch Information

Juniper Networks addressed CVE-2025-52987 in Paragon Automation version 24.1.1. Refer to the Juniper Security Advisory JSA103145 for the complete list of fixed releases and upgrade instructions. Additional support material is available on the Juniper Support Portal.

Workarounds

Place a reverse proxy in front of the Paragon Automation portal and inject X-Frame-Options: DENY and X-Content-Type-Options: nosniff on all responses.
Add a Content Security Policy header with frame-ancestors 'self' to block cross-origin framing at the browser.
Reduce session lifetimes and require re-authentication for sensitive configuration changes to limit the exploitation window.

bash

# Example NGINX reverse proxy header injection for the Paragon portal
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Content-Security-Policy "frame-ancestors 'self'" always;