CVE-2019-0023 : Security Advisory and Response

Juniper ATP: Persistent Cross-Site Scripting vulnerability in the Golden VM menu

Understanding CVE-2019-0023

Before version 5.0.3, a vulnerability in the Golden VM menu of Juniper ATP could be exploited by an authenticated user to inject malicious script and extract valuable data and credentials from a web administration session. This could potentially deceive subsequent administrative users into unknowingly performing unauthorized actions on the device. The problem at hand is identified as a persistent cross-site scripting (XSS) weakness in Juniper ATP versions 5.0 and below.

What is CVE-2019-0023?

A persistent cross-site scripting (XSS) vulnerability in the Golden VM menu of Juniper ATP may allow an authenticated user to inject arbitrary script and steal sensitive data and credentials from a web administration session, possibly tricking a follow-on administrative user to perform administrative actions on the device.

The Impact of CVE-2019-0023

CVSS Score: 5.4 (Medium Severity)
Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: Required
Scope: Changed
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: None
Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

Technical Details of CVE-2019-0023

Vulnerability Description

The vulnerability allows an authenticated user to inject malicious scripts, potentially leading to data and credential theft and unauthorized actions on the device.

Affected Systems and Versions

Product: Juniper ATP
Vendor: Juniper Networks
Versions Affected: Custom version 5.0 (less than 5.0.3)

Exploitation Mechanism

The vulnerability can be exploited by an authenticated user through the Golden VM menu to inject malicious scripts.

Mitigation and Prevention

Immediate Steps to Take

Update to version 5.0.3 or later to resolve the issue.
Limit access to trusted administrators from trusted networks to minimize the risk.

Long-Term Security Practices

Regularly monitor and update security patches.
Educate users on safe browsing practices and awareness of social engineering attacks.

Patching and Updates

Ensure all systems are regularly updated with the latest security patches.