A session fixation vulnerability in J-Web on Junos OS may allow an attacker to use social engineering techniques to fix and hijack a J-Web administrators web session and potentially gain administrative access to the device. This issue affects: Juniper Networks Junos OS 12.3 versions prior to 12.3R12-S15 on EX Series; 12.3X48 versions prior to 12.3X48-D85 on SRX Series; 14.1X53 versions prior to 14.1X53-D51; 15.1 versions prior to 15.1F6-S13, 15.1R7-S5; 15.1X49 versions prior to 15.1X49-D180 on SRX Series; 15.1X53 versions prior to 15.1X53-D238; 16.1 versions prior to 16.1R4-S13, 16.1R7-S5; 16.2 versions prior to 16.2R2-S10; 17.1 versions prior to 17.1R3-S1; 17.2 versions prior to 17.2R2-S8, 17.2R3-S3; 17.3 versions prior to 17.3R3-S5; 17.4 versions prior to 17.4R2-S8, 17.4R3; 18.1 versions prior to 18.1R3-S8; 18.2 versions prior to 18.2R3; 18.3 versions prior to 18.3R3; 18.4 versions prior to 18.4R2; 19.1 versions prior to 19.1R1-S2, 19.1R2.
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Junos | Juniper | 12.3 (including) | 12.3 (including) |
| Junos | Juniper | 12.3-r1 (including) | 12.3-r1 (including) |
| Junos | Juniper | 12.3-r11 (including) | 12.3-r11 (including) |
| Junos | Juniper | 12.3-r12 (including) | 12.3-r12 (including) |
| Junos | Juniper | 12.3-r12-s13 (including) | 12.3-r12-s13 (including) |
| Junos | Juniper | 12.3-r12-s14 (including) | 12.3-r12-s14 (including) |
| Junos | Juniper | 12.3-r2 (including) | 12.3-r2 (including) |
| Junos | Juniper | 12.3-r3 (including) | 12.3-r3 (including) |
| Junos | Juniper | 12.3-r4 (including) | 12.3-r4 (including) |
| Junos | Juniper | 12.3-r5 (including) | 12.3-r5 (including) |
| Junos | Juniper | 12.3-r6 (including) | 12.3-r6 (including) |
| Junos | Juniper | 12.3-r7 (including) | 12.3-r7 (including) |
| Junos | Juniper | 12.3-r8 (including) | 12.3-r8 (including) |
| Junos | Juniper | 12.3-r9 (including) | 12.3-r9 (including) |
Such a scenario is commonly observed when:
In the generic exploit of session fixation vulnerabilities, an attacker creates a new session on a web application and records the associated session identifier. The attacker then causes the victim to associate, and possibly authenticate, against the server using that session identifier, giving the attacker access to the user’s account through the active session.