Lucene search

JuniperVULNRICHMENT:CVE-2024-39523

HistoryJul 11, 2024 - 4:00 p.m.

CVE-2024-39523 Junos OS Evolved: CLI parameter processing issue allows privilege escalation

2024-07-1116:00:58

CWE-78

juniper

github.com

cve-2024-39523

juniper networks

privilege escalation

cli parameter processing

vulnerability

junos os evolved

20.4r3-s7-evo

21.2r3-s8-evo

21.4r3-s7-evo

22.1r3-s6-evo

22.2r3-evo

22.3r2-evo

22.4r2-evo

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

7.4

Confidence

High

EPSS

Percentile

9.9%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to ‘root’ leading to a full compromise of the system.

The Junos OS Evolved CLI doesn’t properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.

This issue affects Junos OS Evolved:

All versions before 20.4R3-S7-EVO,
21.2-EVO versions before 21.2R3-S8-EVO,
21.4-EVO versions before 21.4R3-S7-EVO,
22.1-EVO versions before 22.1R3-S6-EVO,
22.2-EVO versions before 22.2R3-EVO,
22.3-EVO versions before 22.3R2-EVO,
22.4-EVO versions before 22.4R2-EVO.

CNA Affected

[
  {
    "vendor": "Juniper Networks",
    "product": "Junos OS Evolved",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "20.4R3-S7-EVO",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "21.2-EVO",
        "lessThan": "21.2R3-S8-EVO",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "21.4-EVO",
        "lessThan": "21.4R3-S7-EVO",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.1-EVO",
        "lessThan": "22.1R3-S6-EVO",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.2-EVO",
        "lessThan": "22.2R3-EVO",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.3-EVO",
        "lessThan": "22.3R2-EVO",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.4-EVO",
        "lessThan": "22.4R2-EVO",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*"
    ],
    "vendor": "juniper",
    "product": "junos_os_evolved",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "20.4r3-s7",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:o:juniper:junos_os_evolved:22.1:*:*:*:*:*:*:*"
    ],
    "vendor": "juniper",
    "product": "junos_os_evolved",
    "versions": [
      {
        "status": "affected",
        "version": "22.1",
        "lessThan": "22.1r3-s6",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:o:juniper:junos_os_evolved:21.2:-:*:*:*:*:*:*"
    ],
    "vendor": "juniper",
    "product": "junos_os_evolved",
    "versions": [
      {
        "status": "affected",
        "version": "21.2",
        "lessThan": "21.2r3-s8",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:o:juniper:junos_os_evolved:21.4:-:*:*:*:*:*:*"
    ],
    "vendor": "juniper",
    "product": "junos_os_evolved",
    "versions": [
      {
        "status": "affected",
        "version": "21.4",
        "lessThan": "21.4r3-s7",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:o:juniper:junos_os_evolved:22.2:-:*:*:*:*:*:*"
    ],
    "vendor": "juniper",
    "product": "junos_os_evolved",
    "versions": [
      {
        "status": "affected",
        "version": "22.2",
        "lessThan": "22.2r3",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:a:juniper:junos_os_evolved:22.3:*:*:*:*:*:*:*"
    ],
    "vendor": "juniper",
    "product": "junos_os_evolved",
    "versions": [
      {
        "status": "affected",
        "version": "22.3",
        "lessThan": "22.3r2",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:o:juniper:junos_os_evolved:22.4:*:*:*:*:*:*:*"
    ],
    "vendor": "juniper",
    "product": "junos_os_evolved",
    "versions": [
      {
        "status": "affected",
        "version": "22.4",
        "lessThan": "22.4r2",
        "versionType": "custom"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

supportportal.juniper.net/JSA82975

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

7.4

Confidence

High

EPSS

Percentile

9.9%

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2024-39523