Juniper Junos OS Vulnerability (JSA110093)

#TRUSTED 2f0fb551a6d7851b03024cf2008227221087458be706d859927efa5ac12e88aaed15c791112f05e580d3304ebf10b6088483aadd2fc8612820b2f40c8b557e907c6270f0040e0a38c4d79408fd12884c2e8bc275cdbb9adff94ae17f31394b4e45b2f98c1b90df4a5115c0d950f00762276fb5ecc251c1e2552c6cf60d1e24bc9f82e342ccb04a6fd9864fc6c20d80f198924bf28d1a62db9928e9c5bd6401d6e00b8560d4e772e625a94fe489ad884a466e28be5e2d0354c7f83c566d4f5954461a0d33379686e03127ae25c12b6df87f788eb611959da6a1137467b1613de9f7763b9117edd6ac0fb6e5123f88c75b760331f8afd08916653765fb3eb8598239c07619894adea26af421d7a0b8a80999f8111d4d46fb02b1c0ad3b6623e84eaeeb0ad9f31a1b0802814ec861a5fd43fb5229fc20b00db21d57708bfc5259ea81c358dc858555e197a2520e03d447fb0352a1d7b5df99efb922f032e5dc075aa7c2824f391ec8c83d3b820e484c8ea7542a9755390393f0c6a2af4a35e263a8600107a69878c900884c393ec9b696bdc4b609a89681186c674b099447a01509ca67eebf364b141351af9975958cce1f2f0c304451ed347ff0768a4f5b257a029bfd39bcfeed2208999847194d68a5a2aa97321714d00181f7347b7acbfc3b5d3af44999e0c3ad87d7ba9f0f918105397e1f7c0608c3c9c1679a77734451310d
#TRUST-RSA-SHA256 7dca01b123d5b8581e97fd438fa9cebcfbe29a2f6b326f0f74451c5588ccf5c279c6c773e44ad36c90e072741a538c749af667e679fceb12cd9992947be34535e104702ed60e72d08225e5b84184dbc31847d328959e51a363ea444c518e026fdb12277da76f9569c79b58dbe92638218efb26d1af78e707bb4c747170f79620417c87b48a626e3b2a5c4abb5777c716e7eb908ea19c9122f8de42662da09496067352467dfe2500fe7943fd8670dd7e32b38729a7a91ef6e323a0db617d815fbccd20a28cd45b6dd58c77ceda9dd820f0af63b23bc89709e8dae8115dc4a0bc6541fe70f8e5e12734fa7f145ef70810d79d8738a3d4950c3d1946dce89cffdea65ccc3a50758361d13f18912d8bf3432a7da7ecc7107e87d0104c695e055e58eb60640443d4aba073671195bbd837b161243b9c8aa7f4f00acfd9c087262d9d670a301312d00a0ef1d0f6e8505384f0e924db1c8334aca23f6b39bce5496f27a425cff032675a95c7bb968b4cbba14e84d6b14b66a14f71ef06a545b178410f7165d66b96122640c3729e514e9d44bcfa9ca930b9a22aa42d37162f126e7cec126f858b6ced9be85b0c3a971911f2d4f0bed8be1f51e9477adf65b6243769026013062516b688dbf7c43fa6e32e03035df4841f7841419159e76fd08c57e62fc8f9819ec2015dc4cde7a5243762c820625b910332fd9a2b19cdca3af310b272
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
# This file was created in whole or in part by AI.
##

include('compat.inc');

if (description)
{
  script_id(325717);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/07/08");

  script_cve_id("CVE-2026-57054");
  script_xref(name:"JSA", value:"JSA110093");

  script_name(english:"Juniper Junos OS Vulnerability (JSA110093)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA110093
advisory.

  - A Use of Incorrectly-Resolved Name or Reference vulnerability in the URL filtering plugin of Juniper
    Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass web filtering
    and access downstream resources that should be unreachable. (CVE-2026-57054)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://supportportal.juniper.net/s/article/2026-07-Security-Bulletin-Junos-OS-MX-Series-Web-filtering-doesn-t-block-specifically-formatted-URLs-CVE-2026-57054
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?76088b4d");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA110093");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N");
  script_set_attribute(attribute:"cvss4_supplemental", value:"CVSS:4.0/AU:Y/R:A/RE:M");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-57054");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/07/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/07/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/07/08");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version", "Host/Juniper/model");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');

var model = get_kb_item_or_exit('Host/Juniper/model');
if (model !~ "^MX")
{
  audit(AUDIT_DEVICE_NOT_VULN, model);
}

var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');

var vuln_ranges = [
  {'min_ver':'23.4', 'fixed_ver':'23.4R2-S8', 'model':'^MX'},
  {'min_ver':'24.2', 'fixed_ver':'24.2R2-S5', 'model':'^MX'},
  {'min_ver':'24.4', 'fixed_ver':'24.4R2-S4', 'model':'^MX'},
  {'min_ver':'25.2', 'fixed_ver':'25.2R2-S1', 'model':'^MX'},
  {'min_ver':'25.4', 'fixed_ver':'25.4R1-S2', 'model':'^MX', 'fixed_display':'25.4R1-S2, 25.4R2'}
];

var override = TRUE;
var buf1 = junos_command_kb_item(cmd:'show configuration | display set');
if (buf1)
{
  var conf1 = !junos_check_config(buf:buf1, pattern:"^set .*services service-set \S+ web-filter-profile");
  var conf2 = !junos_check_config(buf:buf1, pattern:"^set .*services web-filter profile \S+ url-filter-template \S+ url-filter-database");
  if (conf1 || conf2)
    audit(AUDIT_OS_CONF_NOT_VULN, 'Junos OS');
  override = FALSE;
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix)) audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_WARNING);