mailing list archives
XSS on Juniper JUNOS 11.4 Embedthis Appweb 3.2.3
From: info () andreabodei com
Date: Mon, 11 Nov 2013 14:19:59 GMT
Vulnerability Type: (XSS) Cross-Site Scripting
- Original release date: November 11th, 2013
- Last revised: November 11th, 2013
- Discovered by: Andrea Bodei - A2SECURE
- Severity: 4.3/10 (CVSSv2 Base Scored)
Products and affected versions:
JUNOS up to 11.4 (probably 12.1 and 12.3 vulnerable)
Vulnerability Discovered by: Andrea Bodei - info () andreabodei com
Company: A2SECURE - España
A2Secure Website: http://www.A2secure.com
Vendor Website: http://www.juniper.net
Application Website: http://freecode.com/projects/appweb
Juniper Networks, Inc. is an American manufacturer of networking equipment founded in 1996 by Mark Burke. It is
headquartered in Sunnyvale, California, USA. The company designs and sells high-performance Internet Protocol network
products and services. Juniper's main products include T-series, M-series, E-series, MX-series, and J-series families
of routers, EX-series Ethernet switches and SRX-series security products. Junos, Juniper's own network operating
system, runs on most Juniper products.
JUNOS versions 11.4, 12.1 can be managed by a web login on HTTPS port 443 through EmbedThis AppWeb Webserver 3.2.3 that
is prone to (XSS) Cross Site Vulnerability in the index.php "error" parameter due to insufficient sanitising of special
characters that allows to execute arbitrary scripts in the context of the user's browser.
This vulnerability could be exploited to manipulate a client session, steal tokens, steal credentials, execute
administrative task, impersonate a legitimate user, perform transactions as that user or for phishing.
Juniper should try to upgrade it's OS with latest release of EmbedThis 4.4.1 or better and implement a special
Proof Of Concepts
This URLs just pop up a custom number/lecter/word/phrase:
All information is provided without warranty. The intent is to provide information to secure infrastructure and/or
systems, not to be able to attack or damage. Therefore A2Secure shall not be liable for any direct or indirect damages
that might be caused by using this information.
- XSS on Juniper JUNOS 11.4 Embedthis Appweb 3.2.3 info (Nov 12)