CVE-2025-60009 Overview
CVE-2025-60009 is a stored cross-site scripting (XSS) vulnerability in Juniper Networks Junos Space. An attacker can inject script tags into the CLI Configlet page. When another authenticated user, including an administrator, opens the affected page, the injected script executes with that user's permissions. The flaw affects all versions of Junos Space before 24.1R4 and is tracked under CWE-79. Juniper published details in Juniper Security Advisory JSA103140.
Critical Impact
An attacker who successfully lures an administrator to the poisoned CLI Configlet page can execute arbitrary commands within the Junos Space management plane using that administrator's privileges.
Affected Products
- Juniper Junos Space, all versions before 24.1R4
- Juniper Junos Space 24.1R1
- Juniper Junos Space 24.1R2 and 24.1R3
Discovery Timeline
- 2025-10-09 - CVE-2025-60009 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-60009
Vulnerability Analysis
CVE-2025-60009 is a stored XSS flaw in the Junos Space web management interface. The CLI Configlet feature accepts user-supplied content that is later rendered in another user's browser without proper output encoding. An attacker with access to submit configlet content can embed <script> tags that persist server-side. When any subsequent user renders the page, the payload runs inside the victim's authenticated session. Because Junos Space administrators manage device configurations and network policy, script execution in an administrator context can be pivoted to command execution on managed infrastructure.
Root Cause
The root cause is improper neutralization of input during web page generation in the CLI Configlet component. User-controlled fields are stored and later reflected into HTML without contextual output encoding or a strict Content Security Policy. This matches CWE-79 - Improper Neutralization of Input During Web Page Generation.
Attack Vector
Exploitation requires network access to the Junos Space web UI and user interaction from a second victim who views the poisoned page. An attacker with a low-privileged account submits a payload into the CLI Configlet page. When an administrator later opens that page, the browser executes the attacker's JavaScript in the admin's session. The script can issue authenticated API calls, modify configlets, create users, or trigger device configuration pushes on the administrator's behalf. No verified public proof-of-concept is available at the time of publication.
Detection Methods for CVE-2025-60009
Indicators of Compromise
- Unexpected <script>, onerror, or javascript: strings stored in CLI Configlet records within the Junos Space database.
- Administrative actions such as user creation, role changes, or device config pushes originating from an admin session immediately after that admin visited the CLI Configlet page.
- Outbound HTTP requests from administrator browsers to unknown domains shortly after navigating the Junos Space UI.
Detection Strategies
- Review Junos Space audit logs for configlet create and update events performed by non-administrative accounts.
- Search stored configlet content for HTML and JavaScript tokens that should never appear in legitimate CLI templates.
- Correlate web proxy logs with Junos Space session activity to identify script-driven callbacks from admin workstations.
Monitoring Recommendations
- Alert on any modification to CLI Configlet entries outside of approved change windows.
- Monitor administrator sessions for API calls that are not initiated by expected UI workflows.
- Enable and forward Junos Space application and audit logs to a centralized SIEM for long-term retention and correlation.
How to Mitigate CVE-2025-60009
Immediate Actions Required
- Upgrade Junos Space to version 24.1R4 or later as directed in JSA103140.
- Restrict access to the Junos Space management interface to trusted administrative networks only.
- Audit existing configlets and remove any entries containing HTML or script content.
- Rotate credentials for administrator accounts that may have viewed suspicious CLI Configlet pages.
Patch Information
Juniper Networks addressed CVE-2025-60009 in Junos Space 24.1R4. All prior releases in the 24.1 line, including 24.1R1, 24.1R2, and 24.1R3, are vulnerable. Refer to Juniper Security Advisory JSA103140 for the authoritative fixed-release matrix and upgrade guidance.
Workarounds
- Limit which roles can create or edit CLI Configlet entries until the upgrade is applied.
- Require administrators to access Junos Space from a hardened jump host with a browser dedicated to management traffic.
- Apply strict network ACLs so that only authorized operators can reach the Junos Space web UI.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
