CVE-2013-6618

critical

Published 2013-11-05 · Modified 2026-04-29

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

10.0

Description

jsdm/ajax/port.php in J-Web in Juniper Junos before 10.4R13, 11.4 before 11.4R7, 12.1 before 12.1R5, 12.2 before 12.2R3, and 12.3 before 12.3R1 allows remote authenticated users to execute arbitrary commands via the rsargs parameter in an exec action.

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No mitigations published for this CVE yet.

The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.

✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here with source_tier=community-verified.

Exploits

Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.

Exploit-DB

EDB-29544 webapps php text · 2 KB

Sense of Security · 2013-11-12

Juniper Junos J-Web - Privilege Escalation

text exploit Source: Exploit-DB

Sense of Security - Security Advisory - SOS-13-003 security advisory

Release Date.              10-Sep-2013
Last Update.               -              
Vendor Notification Date.  27-Sep-2012
Product.                   Juniper Junos J-Web 
Platform.                  Junos
Affected versions.         All builds prior to 2013-02-28 are affected
Severity Rating.           Medium
Impact.                    Privilege escalation
Attack Vector.             From remote with read-only authentication
Solution Status.           Vendor patch (not verified by SOS)
                           Disable J-Web or limit access
CVE reference.             CVE - not yet assigned

Details.
The J-Web is a GUI based network management application used on Junos 
devices. The web application is vulnerable to a remote code execution 
vulnerability which permits privilege escalation. The file/jsdm/ajax
/port.php allows execution of arbitrary user supplied PHP code via the
rs POST parameter. Code executes with UID=0 (root) privileges, however
you are confined to a chroot. Privilege escalation can be achieved by 
waiting for an administrator to log in and reading the contents of /tmp
to hijack their session.

Proof of Concept.
Code execution: Execute a command inside the Chroot: 
  POST /jsdm/ajax/port.php 
  rs=exec&rsargs[]=echo “hello” 

Privilege escalation: Read /tmp and hijack a session 
  POST /jsdm/ajax/port.php 
  rs=file_get_contents&rsargs[]=/tmp


Solution.
All Junos OS software releases built on or after 2013-02-28 have fixed
this specific issue. This fix has not been validated by SOS.
As a workaround disable J-Web, or limit access to only trusted hosts.
This issue is being tracked as PR 826518 and is visible on the Juniper
Customer Support website.


Discovered by.
Sense of Security Labs.


About us.
Sense of Security is a leading provider of information security and
risk management solutions. Our team has expert skills in assessment
and assurance, strategy and architecture, and deployment through to
ongoing management. We are Australia's premier application penetration
testing firm and trusted IT security advisor to many of the country's
largest organisations.

References

CWEs

CWE-20

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.