CVE-2020-1631

What is J-Web?

J-Web is the web-based management interface built into Juniper's Junos OS, used to administer routers, switches, and security appliances without relying solely on the CLI. Because J-Web's underlying HTTP/HTTPS service is also shared by several other Junos features — Web Authentication, Dynamic VPN, Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP) — a vulnerability in its core request handling has a wider blast radius than a typical single-feature bug.

Overview

CVE-2020-1631 is a path traversal vulnerability (CWE-22) in the shared HTTP/HTTPS service underlying J-Web and the related features listed above. An attacker can exploit it to escape the intended web-content directory and, in a documented worst case, achieve remote code execution (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) on the affected Junos device.

Technical Details

The vulnerability lies in how the shared HTTP/HTTPS handler resolves file paths for requests, failing to adequately restrict directory-traversal sequences before serving or processing the requested resource. Because this handler underpins multiple distinct Junos features rather than being isolated to J-Web alone, any Junos deployment using Web Authentication, Dynamic VPN, ZTP, or Firewall Authentication Pass-Through is potentially exposed even if the administrator never intentionally enabled the J-Web GUI itself.

Discovery

Reported to Juniper through its standard vulnerability disclosure process, addressed in an out-of-cycle security bulletin given the severity.

Exploitation Context

CISA added this CVE to KEV in March 2022 based on confirmed exploitation. Because Junos devices are core network infrastructure — routers, switches, and security gateways — a path-traversal-to-RCE vulnerability here can provide an attacker a foothold with visibility into and control over network traffic flowing through the device.

Remediation

1. Apply Juniper's fixed Junos OS release per the vendor's out-of-cycle security bulletin immediately.
2. Disable J-Web and related HTTP/HTTPS-based features (Web Authentication, Dynamic VPN, ZTP) if they are not actively required for your deployment, closing the exposure regardless of patch timing.
3. Restrict management interface access to trusted internal networks only; Junos web management should not be directly internet-facing.
4. Audit which Junos features share the vulnerable HTTP/HTTPS service in your specific deployment, since exposure isn't limited to organizations that explicitly use the J-Web GUI.