Executive Summary

This vulnerability is a clickjacking issue in the web portal of Juniper Networks Paragon Automation (Pathfinder, Planner, Insights). It occurs because the application does not set the appropriate X-Frame-Options and X-Content-Type HTTP headers. This allows an attacker to trick users into interacting with the web interface in a way controlled by the attacker.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can impact you by allowing attackers to deceive users into performing unintended actions on the Paragon Automation web portal. This could lead to unauthorized operations or manipulation of the system through the user's interaction with a maliciously crafted interface.

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if the Juniper Networks Paragon Automation web portal responses lack the appropriate X-Frame-Options and X-Content-Type HTTP headers. For example, you can use curl commands to inspect the HTTP headers: curl -I https://<paragon-automation-url> and look for the absence of X-Frame-Options and X-Content-Type headers.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating Juniper Networks Paragon Automation to version 24.1.1 or later, where the vulnerability is fixed. If updating is not immediately possible, consider implementing web server or proxy configurations to add appropriate X-Frame-Options and X-Content-Type headers to the HTTP responses to prevent clickjacking attacks.

Useful 0 Not Useful 0