Lucene search

JuniperVULNRICHMENT:CVE-2024-39524

HistoryJul 11, 2024 - 4:01 p.m.

CVE-2024-39524 Junos OS Evolved: CLI parameter processing issue allows privilege escalation

2024-07-1116:01:32

CWE-78

juniper

github.com

juniper networks junos os evolved

cli

vulnerability

privilege escalation

parameter processing

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

7.4

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to ‘root’ leading to a full compromise of the system.

The Junos OS Evolved CLI doesn’t properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.

This issue affects Junos OS Evolved:

All versions before 20.4R3-S7-EVO,

21.2-EVO versions before 21.2R3-S8-EVO,

21.4-EVO versions before 21.4R3-S7-EVO,

22.2-EVO versions before 22.2R3-EVO,

22.3-EVO versions before 22.3R2-EVO,

22.4-EVO versions before 22.4R2-EVO.

CNA Affected

[
  {
    "vendor": "Juniper Networks",
    "product": "Junos OS Evolved",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "20.4R3-S7-EVO",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "21.2-EVO",
        "lessThan": "21.2R3-S8-EVO",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "21.4-EVO",
        "lessThan": "21.4R3-S7-EVO",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.2-EVO",
        "lessThan": "22.2R3-EVO",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.3-EVO",
        "lessThan": "22.3R2-EVO",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.4-EVO",
        "lessThan": "22.4R2-EVO",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*"
    ],
    "vendor": "juniper",
    "product": "junos_os_evolved",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "lessThan": "20.4r3-s7",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:o:juniper:junos_os_evolved:21.2:*:*:*:*:*:*:*",
      "cpe:2.3:o:juniper:junos_os_evolved:21.4:*:*:*:*:*:*:*",
      "cpe:2.3:o:juniper:junos_os_evolved:22.2:*:*:*:*:*:*:*",
      "cpe:2.3:o:juniper:junos_os_evolved:22.3:*:*:*:*:*:*:*",
      "cpe:2.3:o:juniper:junos_os_evolved:22.4:*:*:*:*:*:*:*"
    ],
    "vendor": "juniper",
    "product": "junos_os_evolved",
    "versions": [
      {
        "status": "affected",
        "version": "21.2",
        "lessThan": "21.2r3-8s",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "21.4",
        "lessThan": "21.4r3-s7",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.2",
        "lessThan": "22.2r3",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.3",
        "lessThan": "22.3r2",
        "versionType": "semver"
      },
      {
        "status": "affected",
        "version": "22.4",
        "lessThan": "22.4r2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

References

supportportal.juniper.net/JSA82975

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS4

8.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/SC:N/VI:H/SI:N/VA:H/SA:N

AI Score

7.4

Confidence

High

SSVC

Exploitation

none

Automatable

Technical Impact

total

JSON

Related for VULNRICHMENT:CVE-2024-39524