XSS on Juniper JUNOS 11.4 Embedthis Appweb 3.2.3

[info () andreabodei com]

Vulnerability Type: (XSS) Cross-Site Scripting

- Original release date: November 11th, 2013
- Last revised: November 11th, 2013
- Discovered by: Andrea Bodei - A2SECURE
- Severity: 4.3/10 (CVSSv2 Base Scored)

Products and affected versions:
JUNOS up to 11.4 (probably 12.1 and 12.3 vulnerable)

Vulnerability Discovered by: Andrea Bodei - info () andreabodei com
Company: A2SECURE - España
A2Secure Website: http://www.A2secure.com
Vendor Website: http://www.juniper.net
Application Website: http://freecode.com/projects/appweb



======================
Background
======================

Juniper Networks, Inc. is an American manufacturer of networking equipment founded in 1996 by Mark Burke. It is 
headquartered in Sunnyvale, California, USA. The company designs and sells high-performance Internet Protocol network 
products and services. Juniper's main products include T-series, M-series, E-series, MX-series, and J-series families 
of routers, EX-series Ethernet switches and SRX-series security products. Junos, Juniper's own network operating 
system, runs on most Juniper products.



======================
Vulnerability Details
======================

JUNOS versions 11.4, 12.1 can be managed by a web login on HTTPS port 443 through EmbedThis AppWeb Webserver 3.2.3 that 
is prone to (XSS) Cross Site Vulnerability in the index.php "error" parameter due to insufficient sanitising of special 
characters that allows to execute arbitrary scripts in the context of the user's browser.
This vulnerability could be exploited to manipulate a client session, steal tokens, steal credentials, execute 
administrative task, impersonate a legitimate user, perform transactions as that user or for phishing.
Juniper should try to upgrade it's OS with latest release of EmbedThis 4.4.1 or better and implement a special 
characters filtering




======================
Proof Of Concepts
======================

This URLs just pop up a custom number/lecter/word/phrase:

https://xxx.xxx.xxx.xxx/index.php?name=Your_Account&error=1%22%3E%3Cscript%3Ealert%281538%29%3C%2Fscript%3E&uname=bGF

https://xxx.xxx.xxx.xxx/index.php?name=Your_Account&error=1%22%3E%3Cscript%3Ealert%28"HACKED"%29%3C%2Fscript%3E&uname=bGF



======================
Credits/Author
======================

Andrea Bodei
A2Secure.com



======================
Disclaimer
======================

All information is provided without warranty. The intent is to provide information to secure infrastructure and/or 
systems, not to be able to attack or damage. Therefore A2Secure shall not be liable for any direct or indirect damages 
that might be caused by using this information.