CVE-2020-1631
Juniper Junos OS Path Traversal Vulnerability
Description
CVE-2020-1631 is a path traversal vulnerability in Juniper Networks Junos OS that allows an unauthenticated attacker to read sensitive configuration files and system credentials through crafted HTTP requests to the J-Web interface. By manipulating URL path components, an attacker can escape the intended directory and access arbitrary files on the underlying operating system. This vulnerability was added to the CISA Known Exploited Vulnerabilities catalog on March 25, 2022. With an EPSS score of 96.1% (99.7th percentile), exploitation is highly likely for any exposed J-Web interface.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| juniper | junos | 12.3; 12.3x48; 14.1x53; 15.1; 15.1x49; 16.1; 17.2; 17.3; 17.4; 18.1; 18.2; 18.3; 18.4; 19.1; 19.2; 19.3; 19.4; 20.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://kb.juniper.net/JSA11021(Mitigation, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1631(US Government Resource)
Weakness Type
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)
CVE-2020-1631 is classified under CWE-22, which describes vulnerabilities where user input is used to construct file paths without adequate validation, allowing attackers to access files outside the intended directory. The J-Web interface in Junos OS fails to properly sanitize HTTP request paths, enabling directory traversal sequences to read arbitrary files from the system.
Learn more: CWE-22 — Improper Limitation of a Pathname to a Restricted Directory
Impact Analysis
CVE-2020-1631 allows unauthenticated attackers to read sensitive files from Juniper devices running Junos OS with the J-Web interface enabled. The exposed files can include device configuration files containing passwords and SNMP community strings, TLS/SSL private keys, and other sensitive system data. While the vulnerability primarily impacts confidentiality through information disclosure, the leaked credentials and configuration data can be leveraged for further attacks including full device takeover. The network-accessible attack vector with no authentication requirement and low complexity makes this vulnerability particularly dangerous for internet-facing J-Web instances. The EPSS score of 96.1% confirms high exploitation likelihood.
Exploit Maturity
CVE-2020-1631 has been confirmed as actively exploited in the wild by CISA. The path traversal attack technique is well-understood and can be executed with basic HTTP tools such as curl or a web browser, requiring no specialized exploit code. With an EPSS score of 96.1% (99.7th percentile), this vulnerability is highly likely to be exploited against any exposed J-Web interface, and organizations should assume that unpatched, internet-facing Juniper devices are being targeted.
Remediation
- Upgrade Junos OS: Apply the latest Junos OS security patches from Juniper Networks that address CVE-2020-1631.
- Disable or restrict J-Web access: If J-Web is not required, disable it entirely. If required, restrict access to trusted management networks only using firewall rules or access control lists.
- Rotate exposed credentials: Change all passwords, SNMP community strings, API keys, and TLS/SSL certificates that may have been exposed through this vulnerability.
- Monitor for unauthorized access: Review device logs for unusual HTTP requests to J-Web, particularly those containing path traversal sequences such as '../' patterns.
- Implement network segmentation: Ensure management interfaces are isolated on dedicated management VLANs that are not accessible from untrusted networks.
Technical Details
CVE-2020-1631 is a path traversal vulnerability in the J-Web component of Juniper Networks Junos OS. The J-Web interface provides HTTP-based management access to Juniper devices, and the vulnerability exists because the web server fails to properly validate and sanitize URL path components in incoming HTTP requests. An unauthenticated attacker can craft HTTP requests containing directory traversal sequences (such as '../') that escape the J-Web document root and access arbitrary files on the underlying Junos OS filesystem. This allows reading sensitive system files including device configurations, credential stores, and cryptographic key material without any authentication.
Frequently Asked Questions
Is CVE-2020-1631 being actively exploited?
Yes. CISA has confirmed active exploitation of CVE-2020-1631 and added it to the Known Exploited Vulnerabilities catalog. The EPSS score of 96.1% indicates that exploitation is highly likely for any exposed J-Web interface.
What products are affected by CVE-2020-1631?
CVE-2020-1631 affects Juniper Networks Junos OS devices with the J-Web interface enabled. J-Web is a web-based management interface available on Juniper routers, switches, and firewalls running Junos OS.
How do I fix CVE-2020-1631?
Upgrade Junos OS to a patched version as recommended by Juniper Networks. Additionally, disable J-Web if it is not needed, or restrict its access to trusted management networks. Rotate any credentials that may have been exposed.
How severe is CVE-2020-1631?
CVE-2020-1631 is a high-severity path traversal vulnerability that allows unauthenticated reading of sensitive system files. While it is primarily an information disclosure vulnerability, the exposed credentials and configuration data can enable complete device compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.