CVE-2020-1631: Juniper Junos OS Path Traversal Vulnerability

CVE-2020-1631 is a path traversal vulnerability in the HTTP/HTTPS service on Juniper Junos OS. It affects interfaces including J-Web, Web Authentication, Dynamic-VPN (DVPN), Firewall Authentication Pass-Through with Web-Redirect, and Zero Touch Provisioning (ZTP). An unauthenticated attacker can abuse it to achieve remote code execution, which makes prompt attention important for any network that exposes these services.

Public detail is limited to the vendor and CISA descriptions; confirm exact impact, fixed releases, and configuration notes against the Juniper advisory before acting.

How it works

The weakness is classified as CWE-22 (path traversal) and CWE-73 (external control of file name or path). In products that accept HTTP/HTTPS requests and map parts of those requests onto the local filesystem, insufficient validation of path elements can let an attacker supply sequences that escape the intended directory.

When the affected Junos OS HTTP/HTTPS service processes such a request, the attacker may reach files or execution paths outside the normal web root. Because the service is reachable without authentication on the listed features, successful abuse can lead directly to remote code execution on the device. Exact request format and payload mechanics are not provided in the public summary; treat any exploitation claims as unconfirmed until verified against the vendor advisory and your own testing in a lab.

Am I affected? How to find it in your systems

Junos OS commonly runs on Juniper routers, switches, and security gateways. The vulnerable HTTP/HTTPS service is used by J-Web management, web-based authentication, Dynamic-VPN, firewall authentication pass-through with web-redirect, and Zero Touch Provisioning. Any device that has these features enabled and reachable—especially from untrusted networks—should be treated as in scope until proven otherwise.

• Inventory all Juniper devices and record the exact Junos OS version and which of the listed services are enabled.
• Check management and authentication interfaces for HTTP/HTTPS listeners; note whether they are bound to internal-only addresses or exposed more broadly.
• Review configuration for J-Web, Web Authentication, DVPN, web-redirect pass-through, and ZTP; disable any that are not required.
• Confirm affected and fixed versions solely against the Juniper security advisory for CVE-2020-1631; do not rely on third-party version lists.
• In logs and telemetry, look for unusual HTTP requests containing path-traversal patterns (for example, repeated “../” sequences) directed at the management or authentication web services, unexpected process spawns, or configuration changes that coincide with such traffic. Absence of these signs does not prove the device is clean.

How to remediate

Patch first. Apply the Junos OS updates specified by Juniper for CVE-2020-1631, following the vendor’s installation and reboot guidance. CISA’s required action is to apply updates per vendor instructions; schedule the work according to your change process and verify the new version after installation.

• After patching, re-check that the previously exposed services still behave as expected and that no unintended features were re-enabled.
• Harden the remaining attack surface: restrict management and authentication HTTP/HTTPS access to dedicated management networks or jump hosts, enforce strong authentication where the feature allows it, and disable unused web services (J-Web, ZTP web components, etc.).
• Ensure configuration backups and change-control records are current so you can detect unauthorized modifications.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls.

• Segment the devices so that the HTTP/HTTPS listeners used by J-Web, Web Authentication, DVPN, web-redirect, and ZTP are unreachable from untrusted or general user networks; prefer management VRFs or out-of-band access.
• If a web application firewall or reverse proxy sits in front of these interfaces, consider virtual-patching rules that block path-traversal patterns, understanding that such rules are imperfect and must be tuned to avoid breaking legitimate traffic.
• Disable any of the affected features that are not operationally required; turning off the service removes the vulnerable code path.
• Increase monitoring: alert on anomalous requests to the web management ports, new administrative sessions, unexpected file-system or process activity, and any configuration commits outside change windows.
• Document the temporary risk acceptance and the date by which patching will occur.

If your data may have been exposed

Actively exploited remote-code-execution vulnerabilities on network devices can lead to full compromise, credential theft, traffic interception, or lateral movement. Known ransomware use of this CVE is not documented, but that does not rule out other malicious activity. If you have reason to believe a device was exploited, follow your incident-response plan: isolate the device, preserve logs and memory if feasible, rotate credentials and keys that may have been present, and examine downstream systems for follow-on access. As a simple additional check, you can run a free exposure scan of your email addresses against known breach data sets to see whether related accounts have appeared in prior incidents.