Junos OS: SRX Series: Credentials exposed when using HTTP and HTTPS Firewall Pass-through User Authentication

Vulnerability

CVE-2018-0025 affects Juniper Networks SRX Series devices configured for HTTP/HTTPS pass-through authentication. When a client authenticates via this method, the credentials sent in the initial session can be captured by a malicious actor during follow-on HTTP/HTTPS requests through a man-in-the-middle (MITM) attack or by subverted authentic servers. The vulnerability exists in Junos OS versions 12.1X46 prior to 12.1X46-D67, 12.3X48 prior to 12.3X48-D25, and 15.1X49 prior to 15.1X49-D35 on SRX Series. FTP and Telnet pass-through authentication are not affected. [1]

Exploitation

An attacker must be positioned as a man-in-the-middle between the client and the SRX device, or must control an authentic server that the SRX trusts. After the client successfully authenticates via HTTP/HTTPS pass-through, the attacker can intercept subsequent HTTP/HTTPS requests from the same client. These follow-on requests may contain the previously sent credentials, allowing the attacker to capture them. No additional authentication or user interaction beyond the initial login is required for the attacker to harvest credentials. [2]

Impact

Successful exploitation results in disclosure of user credentials (username and password) used for pass-through authentication. With these credentials, an attacker can authenticate to the SRX device or to other services that accept the same credentials, potentially gaining unauthorized network access at the privilege level of the compromised user. The confidentiality of authentication data is compromised, and the attacker may escalate access within the network.

Mitigation

Juniper Networks has released fixed versions: 12.1X46-D67, 12.3X48-D25, and 15.1X49-D35. Administrators should upgrade to these or later releases. No workaround is documented; disabling HTTP/HTTPS pass-through authentication and using FTP or Telnet pass-through (which are not affected) may reduce risk, but this is not a formal mitigation. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. [3]