Tuesday, April 28, 2015

Junos Space Network Management Platform Vulnerabilities

Last year I spent some time looking for bugs in the Juniper Junos Space Network Management Platform . I discovered following security issues:
  • XSS in the event viewer by sending specially crafted syslog traffic log messages
  • XSS contained in ssl certificates
  • XSS in the integrated opennms network monitoring tool by sending specially crafted snmp traps (varbinding oid values are not properly escaped)
  • XSS in opennms by spoofing snmp get responses, for example a hostname containing html
  • Inject commands using the backup functionality
  • Junos Space manages its devices (routers, switches, firewalls) using ssh. However it does not verify ssh host keys, allowing mitm exploits.
The opnennms issues were reported to opennms also:

I reported these issues September last year to Juniper sirt. Only one of them (ssl cert xss) is fixed in the current release (14.1R2).
There are many more security issues which need to be addressed, however Juniper decided to spend its budget on different things .