# Juniper SSLVPN / JunOS RCE and Multiple Vulnerabilities

Six JunOS J-Web flaws: pre-auth phar deserialization to RCE, reflected XSS, XPath injection, path-traversal upload, and LFI chain to code execution.

- Payout: Research
- Severity: critical
- Program: Juniper JunOS J-Web
- Credited: PWNAI Research
- Disclosed: 2022-10-28
- CVE: CVE-2022-22241, CVE-2022-22242, CVE-2022-22243, CVE-2022-22244, CVE-2022-22245, CVE-2022-22246
- Write-up quality: 8/10
- Original: https://pwn.ai/blog/juniper-sslvpn-junos-rce-and-multiple-vulnerabilities
- Library page: https://bugbountylibrary.com/r/blog%3Apwn-ai-blog-juniper-sslvpn-junos-rce-and-multiple-vulnerabilities
- Tags: domain:web impact:rce kind:research platform:research sev:critical tech:php technique:chained technique:source-review vuln:auth-bypass vuln:deserialization vuln:path-traversal vuln:xss

**Target:** J-Web PHP web interface (logging_browse.php, error.php, setup.php, interface.php, Upload.php, jrest.php)
**Root cause:** Multiple: auth check in logging_browse.php doesn't exit on failure enabling pre-auth phar deserialization; check_filename only blocks '/' not backslashes; jrest.php concatenates query tokens into require_once path.
**Steps:**
1. Phar RCE: `POST //jsdm/ajax/logging_browse.php` with `filepath=phar:////pharfile.jpg` triggers deserialization pre-auth, then gadget to arbitrary file write/RCE
2. XSS: `GET /error.php?SERVER_NAME=<script>alert(0)</script>` reflects unescaped
3. XPath: authenticated `GET /jsdm/ajax/wizards/setup/setup.php?cmd=<xpath>` passed to setDate
4. XPath: `POST /modules/monitor/interfaces/interface.php` with raw XPath body reaches send_raw()
5. Upload: `fileName=........\www\dir\new\shell.php` bypasses check_filename (backslash normalized by Apache) writing to /www/dir/new/shell.php
6. LFI: `GET /jrest.php?payload=alol/lol/any\..\..\..\..\any\file` makes require_once include arbitrary PHP file
**How found:** Source review of JunOS PHP codebase: noticed `$user = new user(true)` doesn't exit on failed auth, check_filename only blocks forward slashes, and jrest.php concatenates unsanitized query tokens into require_once.
**Exploitation:** Unauthenticated attacker uploads a phar-wrapped image via the unauthenticated upload page, then POSTs filepath=phar:// to logging_browse.php to trigger deserialization gadget for arbitrary file write and RCE. Alternatively chain reflected XSS to steal admin session, use path-traversal upload to drop a PHP shell, then LFI via jrest.php to execute it.
**Escalation:** XSS steals admin session to reach authenticated upload/LFI; upload path traversal + jrest.php LFI combine into full RCE.
**Insight:** Auth-check lines like `new user(true)` are worthless without an explicit exit/return on failure — grep for constructors whose return value is discarded. Also, filename sanitizers that only block '/' are bypassable with backslashes because Apache normalizes them on Linux.