Juniper Junos OS Vulnerability (JSA103167)

#TRUSTED 75d873db625b3deb273d36e254febbc6ff1f45a57a0a2c30c0b560ff4e7675f4d2400bf0bd059e0d942db0a1a845f79ccfd0034ecbe04a2c6b1e95bdc9bf10df52700abf7042e8503cfca577a8b1422e4e6a7fe771a9b067081246f3cae9598a5cd6258c254732c6d633f4fad64db956b0736b94f3382da634f59e97a76208ab6d303a1fc8f15659b2b868547be6f038a17429adbe7babad2e3380bd32d99fae7e415570b3e9be32d41e9eb0f049c0f023311ab574acbf084b4f971f622ea88ccc02548f70fff76fa100e73f5b7a5450eb55c4a29669e8641fa9269e72fafc41870702f6482bfce2e5436815b9bd688851357b8b5f90afaa922ae72f659818ff83ccf161543892b4b8644ef14e0affdd039e0c6426a26664c0ef9138e613057dc0cdc7ee649716a5a3b2dd6efe3ed11b4cf915b416b62ad780095352354d27d222aeb0f612441970afcc50bf80a8357152e8e5c631cbea79b132ca10488670a218d22cd77fdd7b357ea8ac584a87da3df2e094651fc43cb3d3c261c8a5cbf285aa7acfd677c1ac2a707415008a16b016916a92038846122531b59a11b7f56a4f1a96f4434d61801ae4cbe85233f20fb6009bb34bf2e9713071c7e83b41cec284b1404ddd140ecba6a30df4cfa913dc5d4cee371d7a6d6f5165ad4775a37c7f2dfca4cb0185ea260a1e2bd5bce7de184c6c2747609a2d53193b8745f2b5e51329
#TRUST-RSA-SHA256 09a1df3e8a3f475b4a5439c4d16f18b42f01a5560cb17ddea2c1b80b894c7a6b36e44c034ae3c7c49f891cd3f41dfe5e25669cb3c4aded3a9b12e60e57c78efcd7945ad7bbd99c686c9ca89c55634ef28f74eacc5b53c6cb7a87ba1d1492410618f68845ae7f935f9486feaabe97b227903aaefb04c7f0d395f821a40989e94f55e498fc81424653f794cdd80f1b22f0ad0285dfe369fd73b012dfabe3496f28836d442b3df6be8f5323e27ae66d90fbf5a157a28e501d51a6e403a0a20c1f09d42edb8de48017fb7d1839d83f84d38b15b4038c41933ad7acd254ff395d379ef15cfb13d80409300ec496876ad51e8e46d407b924f831d841a42b0ce29e3729c2f710f110222fa1be02d897fb02c87482d3ca6ac683f1152f585453423d46258e7aff810ea904a04fee4d2a4d0fe338e56ad6f8590d561bca90682ba933b0b28c9de89f03bc1e8369326eceebf5c45b58941deebd1e8d696376df5e853f8283fad15294d4c210b3c9de2eead0eb51e391b1053a363a22e31e4eb5abc3a959ed4d2ed510764806a4d1032611ab789c71801b6a42468d551e555d0f098de9e4b970d750f36b86936b94d8f48fbe5f33037f763865cda62dcd7b026f439339a065b5230b71a1685baecb8fcdff60441d84903010f70f90ae2333ee94fb9879c3e32ce4131c9045d2b17c482fa10c4508a84602ecf515ac6c3e5ad052296d066c06
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(271400);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/10/24");

  script_cve_id("CVE-2025-59980");
  script_xref(name:"JSA", value:"JSA103167");
  script_xref(name:"IAVA", value:"2025-A-0740");

  script_name(english:"Juniper Junos OS Vulnerability (JSA103167)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA103167
advisory.

  - An Authentication Bypass by Primary Weakness in the FTP server of Juniper Networks Junos OS allows an
    unauthenticated, network-based attacker to get limited read-write access to files on the device. When the
    FTP server is enabled and a user named ftp or anonymous is configured, that user can login without
    providing the configured password and then has read-write access to their home directory. This issue
    affects Junos OS: * all versions before 22.4R3-S8, * 23.2 versions before 23.2R2-S3, * 23.4 versions
    before 23.4R2. (CVE-2025-59980)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2025-10-Security-Bulletin-Junos-OS-When-a-user-with-the-name-ftp-or-anonymous-is-configured-unauthenticated-filesystem-access-is-allowed-CVE-2025-59980
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?feb98b3a");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA103167");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/AU:Y/RE:M");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-59980");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/10/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/10/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/10/24");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');

var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'0.0',  'fixed_ver':'22.4R3-S8'},
  {'min_ver':'23.2', 'fixed_ver':'23.2R2-S3'},
  {'min_ver':'23.4', 'fixed_ver':'23.4R2'}
];

var override = TRUE;
var buf = junos_command_kb_item(cmd:'show configuration | display set');
if (buf)
{
  override = FALSE;
  var conf1 = junos_check_config(buf:buf, pattern:"^set system services ftp");
  var conf2 = junos_check_config(buf:buf, pattern:"^set system login user (ftp|anonymous)");
  if (!(conf1 && conf2))
    audit(AUDIT_OS_CONF_NOT_VULN, 'Junos OS');
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_WARNING);