Juniper Session Smart Router Authentication Bypass (CVE-2025-21589)

let JuniperMgmtPorts = dynamic([80, 443, 830, 8080, 8443, 4505, 4506]);
let SuspiciousUserAgents = dynamic(['python-requests', 'curl', 'wget', 'Go-http-client', 'libwww-perl', 'masscan', 'zgrab']);
union
(
    CommonSecurityLog
    | where TimeGenerated >= ago(24h)
    | where DeviceVendor =~ "Juniper" or DeviceProduct has_any ("Session Smart", "SSR", "Conductor")
    | where Activity has_any ("auth_bypass", "authentication_bypass", "unauthorized_access", "admin_access")
    | project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, DestinationIP, DestinationPort, Activity, AdditionalExtensions
),
(
    AzureNetworkAnalytics_CL
    | where TimeGenerated >= ago(24h)
    | where DestPort_d in (JuniperMgmtPorts)
    | where SrcIP_s !in (toscalar(trustedNetworks | summarize make_list(CIDR)))
    | project TimeGenerated, SrcIP = SrcIP_s, DestIP = DestIP_s, DestPort = DestPort_d, FlowDirection_s
),
(
    W3CIISLog
    | where TimeGenerated >= ago(24h)
    | where csUriStem has_any ("/api/v1", "/rest", "/conductor", "/admin", "/login")
    | where scStatus in (200, 302) and csMethod in ("GET", "POST")
    | where csUserAgent has_any (SuspiciousUserAgents)
    | project TimeGenerated, cIP, csUriStem, scStatus, csMethod, csUserAgent
)
| summarize EventCount = count(), UniqueEndpoints = dcount(DestinationIP) by SourceIP, bin(TimeGenerated, 5m)
| where EventCount > 5
| extend AlertSeverity = "Critical"
| extend CVE = "CVE-2025-21589"
| project TimeGenerated, SourceIP, EventCount, UniqueEndpoints, AlertSeverity, CVE

index=network OR index=firewall OR index=juniper
(sourcetype="juniper:junos:syslog" OR sourcetype="juniper:ssr" OR sourcetype="juniper:conductor" OR sourcetype="cisco:asa" OR sourcetype="pan:traffic")
| eval is_juniper_mgmt=if(match(dest_port, "^(80|443|830|8080|8443|4505|4506)$"), 1, 0)
| eval is_suspicious_ua=if(match(http_user_agent, "python-requests|curl|wget|Go-http-client|libwww-perl|masscan|zgrab"), 1, 0)
| eval is_auth_event=if(match(action, "bypass|unauthorized|auth_fail|no_auth|unauthenticated"), 1, 0)
| eval is_admin_path=if(match(uri_path, "\/api\/v1|\/rest\/|\/conductor\/|\/admin|\/login"), 1, 0)
| where is_juniper_mgmt=1 OR is_auth_event=1
| eval risk_score=is_suspicious_ua*30 + is_auth_event*40 + is_admin_path*20 + is_juniper_mgmt*10
| where risk_score >= 40
| stats count AS event_count, values(uri_path) AS accessed_paths, values(http_user_agent) AS user_agents, max(risk_score) AS max_risk, earliest(_time) AS first_seen, latest(_time) AS last_seen BY src_ip, dest_ip, dest_port
| where event_count >= 3
| eval cve="CVE-2025-21589"
| eval severity="critical"
| eval vendor="Juniper Networks"
| table _time, src_ip, dest_ip, dest_port, event_count, accessed_paths, user_agents, max_risk, first_seen, last_seen, cve, severity, vendor
| sort -max_risk

sequence by source.ip with maxspan=10m
  [network where destination.port in (80, 443, 830, 8080, 8443) and
   network.direction == "ingress" and
   (observer.vendor like~ "Juniper*" or observer.product like~ "*Session Smart*" or observer.product like~ "*SSR*" or observer.product like~ "*Conductor*")]
  [any where
   (event.category == "authentication" and event.outcome == "failure") or
   (http.request.method in ("GET", "POST") and url.path like~ "*/api/v1*" or url.path like~ "*/conductor*" or url.path like~ "*/admin*") or
   (user_agent.original like~ "*python-requests*" or user_agent.original like~ "*curl*" or user_agent.original like~ "*Go-http-client*")]
  [any where
   (event.category == "authentication" and event.outcome == "success") or
   (http.response.status_code in (200, 302) and url.path like~ "*/admin*")]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  username,
  eventcount,
  CATEGORYNAME(category) AS event_category,
  LOGSOURCENAME(logsourceid) AS log_source,
  "devicevendor",
  "deviceproduct",
  URL,
  "HTTP_USER_AGENT"
FROM events
WHERE
  LAST 24 HOURS
  AND (
    LOWER("devicevendor") LIKE '%juniper%'
    OR LOWER("deviceproduct") LIKE '%session smart%'
    OR LOWER("deviceproduct") LIKE '%ssr%'
    OR LOWER("deviceproduct") LIKE '%conductor%'
  )
  AND (
    destinationport IN (80, 443, 830, 8080, 8443, 4505, 4506)
    OR LOWER(URL) LIKE '%/api/v1%'
    OR LOWER(URL) LIKE '%/conductor%'
    OR LOWER(URL) LIKE '%/admin%'
  )
  AND (
    LOWER("HTTP_USER_AGENT") LIKE '%python%'
    OR LOWER("HTTP_USER_AGENT") LIKE '%curl%'
    OR LOWER("HTTP_USER_AGENT") LIKE '%wget%'
    OR LOWER("HTTP_USER_AGENT") LIKE '%go-http%'
    OR category IN (5018, 5019, 5021)
  )
GROUP BY sourceip, destinationip, destinationport
HAVING COUNT(*) >= 3
ORDER BY eventcount DESC

_sourceCategory=juniper* OR _sourceCategory=network/firewall OR _sourceCategory=syslog/juniper
| where _sourceName matches /juniper|ssr|conductor|session.smart/i
| parse "src_ip=*" as src_ip nodrop
| parse "dst_port=*" as dst_port nodrop
| parse "url=*" as request_url nodrop
| parse "user_agent=*" as user_agent nodrop
| parse "action=*" as action nodrop
| parse "status=*" as status_code nodrop
| where dst_port in ("80", "443", "830", "8080", "8443", "4505", "4506")
  OR request_url matches /\/api\/v1|\/conductor|\/admin|\/login/
| eval is_suspicious_agent = if(user_agent matches /python-requests|curl\/|wget\/|Go-http-client|libwww-perl/, 1, 0)
| eval is_bypass_indicator = if(action matches /bypass|unauthorized|unauthenticated|no_auth/, 1, 0)
| eval is_success = if(status_code in ("200", "201", "302") AND request_url matches /\/admin|\/conductor\/config|\/api\/v1\/users/, 1, 0)
| eval risk = is_suspicious_agent * 30 + is_bypass_indicator * 50 + is_success * 40
| where risk >= 50
| timeslice 5m
| stats count as event_count, sum(risk) as total_risk, values(request_url) as urls, values(user_agent) as agents by src_ip, _timeslice
| where event_count >= 2
| sort by total_risk desc
| fields _timeslice, src_ip, event_count, total_risk, urls, agents

rule CVE_2025_21589_Juniper_Auth_Bypass {
  meta:
    author = "df00tech Detection Engineering"
    description = "Detects authentication bypass attempts against Juniper Session Smart Router (CVE-2025-21589)"
    severity = "CRITICAL"
    priority = "HIGH"
    cve = "CVE-2025-21589"
    cvss = "9.8"
    mitre_attack = "T1190, T1078"
    reference = "https://kb.juniper.net/JSA94663"

  events:
    $network.metadata.event_type = "NETWORK_HTTP"
    $network.principal.ip = $src_ip
    $network.target.ip = $dst_ip
    (
      $network.target.port = 443 or
      $network.target.port = 8443 or
      $network.target.port = 830 or
      $network.target.port = 8080
    )
    (
      re.regex($network.network.http.user_agent, `(?i)(python-requests|curl/|wget/|Go-http-client|libwww-perl|masscan|zgrab)`) or
      re.regex($network.network.http.request_url, `(?i)(/api/v1|/conductor|/admin|/login|/rest/)`) or
      re.regex($network.security_result.description, `(?i)(bypass|unauthorized|unauthenticated|authentication.bypass)`)
    )
    (
      re.regex($network.target.hostname, `(?i)(ssr|conductor|session.smart|juniper|wan.assurance)`) or
      re.regex($network.observer.product_name, `(?i)(session.smart|ssr|conductor|juniper)`)
    )

  match:
    $src_ip over 10m

  outcome:
    $risk_score = max(
      if(re.regex($network.network.http.user_agent, `(?i)(python-requests|curl/|Go-http-client)`), 30, 0) +
      if(re.regex($network.security_result.description, `(?i)(bypass|unauthorized)`), 50, 0) +
      if(re.regex($network.network.http.request_url, `(?i)(/admin|/conductor/config|/api/v1/users)`), 20, 0)
    )
    $event_count = count_distinct($network.metadata.id)

  condition:
    $network and $risk_score >= 50 and $event_count >= 2
}

#event_simpleName=NetworkConnectIP4 OR #event_simpleName=NetworkConnectIP6 OR #event_simpleName=HttpRequest
| $device_vendor = "Juniper"
| RemotePort in [80, 443, 830, 8080, 8443, 4505, 4506]
| (
    HttpUserAgent = /(?i)(python-requests|curl\/|wget\/|Go-http-client|libwww-perl)/
  OR
    HttpUrl = /(?i)(\/api\/v1|\/conductor|\/admin|\/login)/
  OR
    #event_simpleName = "AuthActivityAuditEvent" AND UserAuthenticationResult = "AuthBypassAttempt"
)
| groupBy([RemoteAddressIP4, LocalAddressIP4, RemotePort], function=[
    count(aid, as=event_count),
    collect(HttpUserAgent, as=user_agents),
    collect(HttpUrl, as=accessed_urls),
    min(@timestamp, as=first_seen),
    max(@timestamp, as=last_seen)
  ])
| event_count >= 3
| eval cve = "CVE-2025-21589"
| eval severity = "critical"
| eval vendor_product = "Juniper Session Smart Router"
| sort(event_count, order=desc)
| table([@timestamp, RemoteAddressIP4, LocalAddressIP4, RemotePort, event_count, user_agents, accessed_urls, first_seen, last_seen, cve, severity])