CVE-2022-22157 : Vulnerability Insights and Analysis

A traffic classification vulnerability in Juniper Networks Junos OS on the SRX Series Services Gateways may allow an attacker to bypass Juniper Deep Packet Inspection (JDPI) rules and access unauthorized networks or resources when 'no-syn-check' is enabled on the device. This vulnerability affects various Junos OS versions prior to specific releases and requires the 'security flow tcp-session no-syn-check' configuration to exploit.

Understanding CVE-2022-22157

This vulnerability impacts Juniper Networks Junos OS on SRX Series devices and may lead to unauthorized access due to a flaw in traffic classification.

What is CVE-2022-22157?

The vulnerability enables attackers to bypass JDPI rules and gain access to unauthorized networks by causing the firewall to forward traffic incorrectly.

The Impact of CVE-2022-22157

With a CVSSv3 base score of 7.2 (High Severity), this vulnerability poses a risk of allowing attackers to circumvent security measures and access sensitive resources.

Technical Details of CVE-2022-22157

The vulnerability affects Juniper Networks Junos OS versions prior to specific releases when 'no-syn-check' configuration is present.

Vulnerability Description

JDPI incorrectly classifies out-of-state asymmetric TCP flows, causing the firewall to forward traffic that should have been denied, thus allowing unauthorized access.

Affected Systems and Versions

The vulnerability impacts SRX Series devices running Junos OS versions prior to 18.4R2-S9, 18.4R3-S9, and subsequent releases listed in the Juniper advisory.

Exploitation Mechanism

Exploiting this vulnerability requires enabling 'set security flow tcp-session no-syn-check' on the affected device.

Mitigation and Prevention

To address CVE-2022-22157, users should take immediate steps to secure their systems and implement long-term security measures.

Immediate Steps to Take

Remove 'security flow tcp-session no-syn-check' configuration.
Enable AppID cache configuration as an additional workaround.

Long-Term Security Practices

Regularly update Junos OS to versions that address this specific issue and stay informed about security advisories released by Juniper Networks.

Patching and Updates

Juniper has released software updates for Junos OS versions affected by this vulnerability. Ensure your systems are updated to versions 18.4R2-S9, 18.4R3-S9, 19.1R2-S3, 19.1R3-S6, and subsequent releases.