CVE-2019-0022
📋 TL;DR
Juniper ATP versions before 5.0.3 contain hard-coded credentials in the Cyphort Core instance, allowing attackers to gain full administrative control of the system. This affects all installations running vulnerable versions, regardless of configuration. The vulnerability is critical due to the complete system compromise it enables.
💻 Affected Systems
- Juniper Networks Advanced Threat Prevention (ATP)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system takeover allowing attacker to exfiltrate all security data, disable protection, pivot to other systems, and maintain persistent access.
Likely Case
Attacker gains administrative access to the ATP system, potentially disabling security monitoring and accessing sensitive threat intelligence data.
If Mitigated
If isolated from internet and internal networks, impact limited to the ATP system itself, though still represents complete compromise of that system.
🎯 Exploit Status
Hard-coded credentials make exploitation trivial once discovered. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.0.3
Vendor Advisory: https://kb.juniper.net/JSA10918
Restart Required: Yes
Instructions:
1. Download Juniper ATP 5.0.3 from Juniper support portal. 2. Backup current configuration. 3. Apply the update via the ATP web interface or CLI. 4. Reboot the system as required. 5. Verify the update was successful.
🔧 Temporary Workarounds
Network Isolation
allIsolate the ATP system from all networks except required management interfaces
Access Control Lists
allImplement strict network ACLs to limit access to ATP management interfaces
🧯 If You Can't Patch
- Immediately isolate the ATP system from all networks
- Monitor for suspicious authentication attempts and system changes
🔍 How to Verify
Check if Vulnerable:
Check ATP version via web interface (System > About) or CLI command 'show version'Check Version:
show versionVerify Fix Applied:
Verify version is 5.0.3 or later and check for any unknown administrative accounts📡 Detection & Monitoring
Log Indicators:
- Unexpected administrative logins
- Configuration changes from unknown users
- Failed login attempts using common credentials
Network Indicators:
- Unexpected connections to ATP management interfaces
- Traffic patterns indicating credential testing
SIEM Query:
source="juniper-atp" AND (event_type="authentication" AND result="success" AND user!="expected_admin")