Vulnerabilities 2010

PR09-16 Juniper Secure Access series (Juniper IVE) XSS

• Advisory publicly released: Wednesday, 9 June 2010
• Vulnerability found: Monday, 12 October 2009
• Vendor informed: Monday, 12 October 2009
• Vulnerability fixed: Wednesday, 9 June 2010
• Severity level: Medium/High

• Credits
  Richard Brain of ProCheckUp Ltd (www.procheckup.com)
• Description
  There is a Cross-site Scripting vulnerability on Junipers, IVE web interface.
  
  Procheckup has found by making a malformed request to the IVE Web interface without authentication, that a vanilla cross site scripting (XSS) attack is possible.
  
  
  Successfully tested on:
  Juniper Networks IVE version 6.5R1 (Build 14599)
  
  Model SA-2000
• Proof of concept
  http://target-domain.foo/dana-na/auth/url_default/welcome.cgi?p=logout&c=37&u=</script><script>alert(1)</script>
• How to fix
  Ensure that the firewall's management interface is disabled on the Internet connected interface, by disabling WeBUI within service
  options on the Internet connected interface.
• References
  
  
• Legal
  Copyright 2009 Procheckup Ltd. All rights reserved.
  
  Permission is granted for copying and circulating this Bulletin to the Internet community for the purpose of alerting them to
  problems, if and only if, the Bulletin is not edited or changed in any way, is attributed to Procheckup, and provided such
  reproduction and/or distribution is performed for non-commercial purposes.
  
  Any other use of this information is prohibited. Procheckup is not liable for any misuse of this information by any third party.