CVE-2017-2343 in Junos
Summary
by MITRE
The Integrated User Firewall (UserFW) feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series devices to provide simple integration of user profiles on top of the existing firewall polices. As part of an internal security review of the UserFW services authentication API, hardcoded credentials were identified and removed which can impact both the SRX Series device, and potentially LDAP and Active Directory integrated points. An attacker may be able to completely compromise SRX Series devices, as well as Active Directory servers and services. When Active Directory is compromised, it may allow access to user credentials, workstations, servers performing other functions such as email, database, etc. Inter-Forest Active Directory deployments may also be at risk as the attacker may gain full administrative control over one or more Active Directories depending on the credentials supplied by the administrator of the AD domains and SRX devices performing integrated authentication of users, groups and devices. To identify if your device is potentially vulnerable to exploitation, check to see if the service is operating; from CLI review the following output: root@SRX-Firewall# run show services user-identification active-directory-access domain-controller status extensive A result of "Status: Connected" will indicate that the service is active on the device. To evaluate if user authentication is occurring through the device: root@SRX-Firewall# run show services user-identification active-directory-access active-directory-authentication-table all Next review the results to see if valid users and groups are returned. e.g. Domain: juniperlab.com Total entries: 3 Source IP Username groups state 172.16.26.1 administrator Valid 192.168.26.2 engg01 engineers Valid 192.168.26.3 guest01 guests Valid Domain: NULL Total entries: 8 Source IP Username groups state 192.168.26.4 Invalid 192.168.26.5 Invalid This will also indicate that Valid users and groups are authenticating through the device. Affected releases are Juniper Networks Junos OS 12.3X48 from 12.3X48-D30 and prior to 12.3X48-D35 on SRX series; 15.1X49 from 15.1X49-D40 and prior to 15.1X49-D50 on SRX series. Devices on any version of Junos OS 12.1X46, or 12.1X47 are unaffected by this issue.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 12/12/2022
The vulnerability described in CVE-2017-2343 represents a critical security flaw within Juniper Networks SRX Series devices that affects the Integrated User Firewall feature introduced in Junos OS version 12.1X47-D10. This vulnerability stems from hardcoded credentials within the UserFW services authentication API that were discovered during an internal security review process. The flaw specifically impacts the Active Directory integration capabilities of these network security devices, creating a potential pathway for attackers to gain complete administrative control over both the SRX Series devices themselves and the integrated Active Directory environments. According to the Common Weakness Enumeration framework, this vulnerability maps to CWE-798, which identifies the use of hardcoded credentials as a significant security risk that can lead to unauthorized access and privilege escalation. The technical implementation of this flaw allows for unauthorized authentication attempts that bypass normal security controls, potentially enabling attackers to establish persistent access to critical network infrastructure.
The operational impact of this vulnerability extends far beyond the immediate compromise of individual SRX devices, as it creates a potential attack vector that can compromise entire Active Directory domains and their associated services. When an attacker successfully exploits this vulnerability, they can gain access to user credentials stored within Active Directory, potentially allowing them to access workstations, servers, email systems, databases, and other critical infrastructure components that rely on Active Directory for authentication and authorization. The risk is particularly severe in inter-forest Active Directory deployments where attackers could potentially gain full administrative control over one or more Active Directory domains depending on the credentials configured by administrators. This type of vulnerability aligns with ATT&CK technique T1078.004, which describes valid accounts used for lateral movement, as compromised credentials can be leveraged to move throughout the network environment and access additional systems. The vulnerability affects specific versions of Junos OS including 12.3X48-D30 and prior through 12.3X48-D34, as well as 15.1X49-D40 and prior through 15.1X49-D49 on SRX series devices, while versions 12.1X46 and 12.1X47 remain unaffected by this particular flaw.
The detection and identification of this vulnerability requires specific command-line interface checks that administrators must perform to determine if the service is active and functioning within their network environment. The diagnostic commands include running show services user-identification active-directory-access domain-controller status extensive to verify if the service shows "Status: Connected" and examining the active-directory-authentication-table to confirm that valid users and groups are authenticating through the device. These checks reveal the presence of legitimate authentication activity that indicates the vulnerability is active and potentially exploitable within the network infrastructure. Organizations must also be aware that the vulnerability exists in specific version ranges and that devices running unaffected versions of Junos OS should not be at risk. The remediation process involves updating to patched versions of Junos OS, as the hardcoded credentials were identified and removed during the internal security review process, effectively eliminating the attack vector that allowed unauthorized access to the integrated authentication systems. This vulnerability demonstrates the importance of proper credential management and the risks associated with hardcoded secrets in network security infrastructure, particularly in authentication systems that serve as gateways to enterprise environments.