Lucene search

JuniperVULNRICHMENT:CVE-2024-39520

HistoryJul 11, 2024 - 3:56 p.m.

CVE-2024-39520 Junos OS Evolved: CLI parameter processing issue allows privilege escalation

2024-07-1115:56:53

CWE-78

juniper

github.com

juniper networks

cli

privilege escalation

vulnerability

junos os evolved

command processing

escalation

version 20.4r3-s6-evo

version 21.2r3-s4-evo

version 21.4r3-s6-evo

version 22.2r2-s1-evo

version 22.2r3-evo

version 22.3r2-evo

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

7.4

Confidence

High

EPSS

Percentile

9.9%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to ‘root’ leading to a full compromise of the system.

The Junos OS Evolved CLI doesn’t properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.

This issue affects Junos OS Evolved:

All version before 20.4R3-S6-EVO,
21.2-EVO versions before 21.2R3-S4-EVO,
21.4-EVO versions before 21.4R3-S6-EVO,
22.2-EVO versions before 22.2R2-S1-EVO, 22.2R3-EVO,
22.3-EVO versions before 22.3R2-EVO.

CNA Affected

[
  {
    "vendor": "Juniper Networks",
    "product": "Junos OS Evolved",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "20.4R3-S6-EVO",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "21.2-EVO",
        "lessThan": "21.2R3-S4-EVO",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "21.4-EVO",
        "lessThan": "21.4R3-S6-EVO",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.2-EVO",
        "lessThan": "22.2R2-S1-EVO, 22.2R3-EVO",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.3-EVO",
        "lessThan": "22.3R2-EVO",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:juniper:junos_os_evolved:21.2:*:*:*:*:*:*:*",
      "cpe:2.3:o:juniper:junos_os_evolved:21.4:*:*:*:*:*:*:*",
      "cpe:2.3:o:juniper:junos_os_evolved:22.2:*:*:*:*:*:*:*",
      "cpe:2.3:o:juniper:junos_os_evolved:22.3:*:*:*:*:*:*:*"
    ],
    "vendor": "juniper",
    "product": "junos_os_evolved",
    "versions": [
      {
        "status": "affected",
        "version": "21.2",
        "lessThan": "21.2r3-s4",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "21.4",
        "lessThan": "21.4r3-s6",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.2",
        "lessThan": "22.2r2-s1",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.3",
        "lessThan": "22.3r2",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.2",
        "lessThan": "22.2r3",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unknown"
  },
  {
    "cpes": [
      "cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*"
    ],
    "vendor": "juniper",
    "product": "junos_os_evolved",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "20.4r3-s6",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

supportportal.juniper.net/JSA82975

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

7.4

Confidence

High

EPSS

Percentile

9.9%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2024-39520