fkie_cve-2024-39521
Vulnerability from fkie_nvd
Published
2024-07-11 16:15
Modified
2024-11-21 09:27
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system. The Junos OS Evolved CLI doesn't properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level. This issue affects Junos OS Evolved:  * 21.1-EVO versions 21.1R1-EVO and later before 21.2R3-S8-EVO,  * 21.4-EVO versions before 21.4R3-S7-EVO, * 22.1-EVO versions before 22.1R3-S6-EVO,  * 22.2-EVO versions before 22.2R3-EVO, * 22.3-EVO versions before 22.3R2-EVO.
References
sirt@juniper.nethttps://supportportal.juniper.net/JSA82975Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://supportportal.juniper.net/JSA82975Vendor Advisory
Impacted products
Vendor Product Version
juniper junos_os_evolved *
juniper junos_os_evolved 21.2
juniper junos_os_evolved 21.2
juniper junos_os_evolved 21.2
juniper junos_os_evolved 21.2
juniper junos_os_evolved 21.2
juniper junos_os_evolved 21.2
juniper junos_os_evolved 21.2
juniper junos_os_evolved 21.2
juniper junos_os_evolved 21.2
juniper junos_os_evolved 21.2
juniper junos_os_evolved 21.2
juniper junos_os_evolved 21.2
juniper junos_os_evolved 21.2
juniper junos_os_evolved 21.2
juniper junos_os_evolved 21.2
juniper junos_os_evolved 21.4
juniper junos_os_evolved 21.4
juniper junos_os_evolved 21.4
juniper junos_os_evolved 21.4
juniper junos_os_evolved 21.4
juniper junos_os_evolved 21.4
juniper junos_os_evolved 21.4
juniper junos_os_evolved 21.4
juniper junos_os_evolved 21.4
juniper junos_os_evolved 21.4
juniper junos_os_evolved 21.4
juniper junos_os_evolved 21.4
juniper junos_os_evolved 21.4
juniper junos_os_evolved 21.4
juniper junos_os_evolved 21.4
juniper junos_os_evolved 22.2
juniper junos_os_evolved 22.2
juniper junos_os_evolved 22.2
juniper junos_os_evolved 22.2
juniper junos_os_evolved 22.2
juniper junos_os_evolved 22.3
juniper junos_os_evolved 22.3
juniper junos_os_evolved 22.3
juniper junos_os_evolved 22.3


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "AD70555D-B829-4150-9BE1-EDDDB02AC541",
                     versionEndExcluding: "21.2",
                     versionStartIncluding: "21.1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.2:-:*:*:*:*:*:*",
                     matchCriteriaId: "620B0CDD-5566-472E-B96A-31D2C12E3120",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.2:r1:*:*:*:*:*:*",
                     matchCriteriaId: "3EA3DC63-B290-4D15-BEF9-21DEF36CA2EA",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.2:r1-s1:*:*:*:*:*:*",
                     matchCriteriaId: "7E1E57AF-979B-4022-8AD6-B3558E06B718",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.2:r1-s2:*:*:*:*:*:*",
                     matchCriteriaId: "144730FB-7622-4B3D-9C47-D1B7A7FB7EB0",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.2:r2:*:*:*:*:*:*",
                     matchCriteriaId: "7BA246F0-154E-4F44-A97B-690D22FA73DD",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.2:r2-s1:*:*:*:*:*:*",
                     matchCriteriaId: "25D6C07C-F96E-4523-BB54-7FEABFE1D1ED",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.2:r2-s2:*:*:*:*:*:*",
                     matchCriteriaId: "2B70C784-534B-4FAA-A5ED-3709656E2B97",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.2:r3:*:*:*:*:*:*",
                     matchCriteriaId: "60448FFB-568E-4280-9261-ADD65244F31A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.2:r3-s1:*:*:*:*:*:*",
                     matchCriteriaId: "2B770C52-7E3E-4B92-9138-85DEC56F3B22",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.2:r3-s2:*:*:*:*:*:*",
                     matchCriteriaId: "E88AC378-461C-4EFA-A04B-5786FF21FE03",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.2:r3-s3:*:*:*:*:*:*",
                     matchCriteriaId: "3B0AFB30-81DC-465C-9F63-D1B15EA4809A",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.2:r3-s4:*:*:*:*:*:*",
                     matchCriteriaId: "2035F0AC-29E7-478A-A9D0-BAA3A88B3413",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.2:r3-s5:*:*:*:*:*:*",
                     matchCriteriaId: "C34ABD4B-B045-4046-9641-66E3B2082A25",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.2:r3-s6:*:*:*:*:*:*",
                     matchCriteriaId: "6D5DC04F-18DE-403B-BE93-2251F3332C1C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.2:r3-s7:*:*:*:*:*:*",
                     matchCriteriaId: "909FC378-EBFE-4BA9-8393-0C8301438020",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.4:-:*:*:*:*:*:*",
                     matchCriteriaId: "2E907193-075E-45BC-9257-9607DB790D71",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.4:r1:*:*:*:*:*:*",
                     matchCriteriaId: "8B73A41D-3FF5-4E53-83FF-74DF58E0D6C3",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s1:*:*:*:*:*:*",
                     matchCriteriaId: "CEDF46A8-FC3A-4779-B695-2CA11D045AEB",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.4:r1-s2:*:*:*:*:*:*",
                     matchCriteriaId: "39809219-9F87-4583-9DAD-9415DD320B36",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.4:r2:*:*:*:*:*:*",
                     matchCriteriaId: "DB299492-A919-4EBA-A62A-B3CF02FC0A95",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s1:*:*:*:*:*:*",
                     matchCriteriaId: "74ED0939-D5F8-4334-9838-40F29DE3597F",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.4:r2-s2:*:*:*:*:*:*",
                     matchCriteriaId: "C6937069-8C19-4B01-8415-ED7E9EAE2CE2",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.4:r3:*:*:*:*:*:*",
                     matchCriteriaId: "97DB6DD5-F5DD-4AE1-AF2F-8DB9E18FF882",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s1:*:*:*:*:*:*",
                     matchCriteriaId: "21DF05B8-EF7E-422F-8831-06904160714C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s2:*:*:*:*:*:*",
                     matchCriteriaId: "492FCE45-68A1-4378-85D4-C4034FE0D836",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s3:*:*:*:*:*:*",
                     matchCriteriaId: "522114CC-1505-4205-B4B8-797DE1BD833B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s4:*:*:*:*:*:*",
                     matchCriteriaId: "C9D664AB-0FA7-49C7-B6E1-69C77652FBEF",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s5:*:*:*:*:*:*",
                     matchCriteriaId: "9DB01252-2F11-41DB-9023-C74FD723334E",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s6:*:*:*:*:*:*",
                     matchCriteriaId: "F91450D5-F8CE-42EA-BB7E-312FCE024CD1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:21.4:r3-s7:*:*:*:*:*:*",
                     matchCriteriaId: "4E616550-8711-4282-A8A1-11BD5974E650",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:22.2:-:*:*:*:*:*:*",
                     matchCriteriaId: "A3CA3365-F9AF-40DF-8700-30AD4BC58E27",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:22.2:r1:*:*:*:*:*:*",
                     matchCriteriaId: "D77A072D-350A-42F2-8324-7D3AC1711BF9",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:22.2:r1-s1:*:*:*:*:*:*",
                     matchCriteriaId: "83AE395C-A651-4568-88E3-3600544BF799",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:22.2:r2:*:*:*:*:*:*",
                     matchCriteriaId: "B3BE1FD4-DAD9-4357-A2E9-20E5826B0D5C",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:22.2:r2-s2:*:*:*:*:*:*",
                     matchCriteriaId: "F7E76F5F-DB37-4B7F-9247-3CEB4EBD7696",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:22.3:-:*:*:*:*:*:*",
                     matchCriteriaId: "BE2EF84D-55A9-41DC-A324-69E1DC426D0B",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:22.3:r1:*:*:*:*:*:*",
                     matchCriteriaId: "433631CA-3AC4-4D66-9B46-AEA4209347F1",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:22.3:r1-s1:*:*:*:*:*:*",
                     matchCriteriaId: "6E4CD8AD-277A-4FC5-A102-3E151060C216",
                     vulnerable: true,
                  },
                  {
                     criteria: "cpe:2.3:o:juniper:junos_os_evolved:22.3:r1-s2:*:*:*:*:*:*",
                     matchCriteriaId: "4BC09BAC-83E7-48CE-B571-ED49277B2987",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "An Improper Neutralization of Special Elements vulnerability in Juniper Networks Junos OS Evolved commands allows a local, authenticated attacker with low privileges to escalate their privileges to 'root' leading to a full compromise of the system.\n\nThe Junos OS Evolved CLI doesn't properly handle command options in some cases, allowing users which execute specific CLI commands with a crafted set of parameters to escalate their privileges to root on shell level.\n\n\nThis issue affects Junos OS Evolved: \n\n\n\n  *  21.1-EVO versions 21.1R1-EVO and later before 21.2R3-S8-EVO, \n  *  21.4-EVO versions before 21.4R3-S7-EVO,\n  *  22.1-EVO versions before 22.1R3-S6-EVO, \n  *  22.2-EVO versions before 22.2R3-EVO,\n  *  22.3-EVO versions before 22.3R2-EVO.",
      },
      {
         lang: "es",
         value: "Una vulnerabilidad de neutralización incorrecta de elementos especiales en los comandos Juniper Networks Junos OS Evolved permite a un atacante local autenticado con privilegios bajos escalar sus privilegios a 'root', lo que lleva a un compromiso total del sistema. La CLI evolucionada de Junos OS no maneja adecuadamente las opciones de comando en algunos casos, lo que permite a los usuarios que ejecutan comandos CLI específicos con un conjunto de parámetros manipulado escalar sus privilegios a root en el nivel de shell. Este problema afecta a Junos OS Evolved: * 21.1-EVO versiones 21.1R1-EVO y posteriores antes de 21.2R3-S8-EVO, * Versiones 21.4-EVO anteriores a 21.4R3-S7-EVO, * Versiones 22.1-EVO anteriores a 22.1R3-S6- EVO, *versiones 22.2-EVO anteriores a 22.2R3-EVO, *versiones 22.3-EVO anteriores a 22.3R2-EVO.",
      },
   ],
   id: "CVE-2024-39521",
   lastModified: "2024-11-21T09:27:55.090",
   metrics: {
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "LOCAL",
               availabilityImpact: "HIGH",
               baseScore: 7.8,
               baseSeverity: "HIGH",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "LOW",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 1.8,
            impactScore: 5.9,
            source: "sirt@juniper.net",
            type: "Primary",
         },
      ],
      cvssMetricV40: [
         {
            cvssData: {
               Automatable: "NOT_DEFINED",
               Recovery: "NOT_DEFINED",
               Safety: "NOT_DEFINED",
               attackComplexity: "LOW",
               attackRequirements: "NONE",
               attackVector: "LOCAL",
               availabilityRequirement: "NOT_DEFINED",
               baseScore: 8.5,
               baseSeverity: "HIGH",
               confidentialityRequirement: "NOT_DEFINED",
               exploitMaturity: "NOT_DEFINED",
               integrityRequirement: "NOT_DEFINED",
               modifiedAttackComplexity: "NOT_DEFINED",
               modifiedAttackRequirements: "NOT_DEFINED",
               modifiedAttackVector: "NOT_DEFINED",
               modifiedPrivilegesRequired: "NOT_DEFINED",
               modifiedSubAvailabilityImpact: "NOT_DEFINED",
               modifiedSubConfidentialityImpact: "NOT_DEFINED",
               modifiedSubIntegrityImpact: "NOT_DEFINED",
               modifiedUserInteraction: "NOT_DEFINED",
               modifiedVulnAvailabilityImpact: "NOT_DEFINED",
               modifiedVulnConfidentialityImpact: "NOT_DEFINED",
               modifiedVulnIntegrityImpact: "NOT_DEFINED",
               privilegesRequired: "LOW",
               providerUrgency: "NOT_DEFINED",
               subAvailabilityImpact: "NONE",
               subConfidentialityImpact: "NONE",
               subIntegrityImpact: "NONE",
               userInteraction: "NONE",
               valueDensity: "NOT_DEFINED",
               vectorString: "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
               version: "4.0",
               vulnAvailabilityImpact: "HIGH",
               vulnConfidentialityImpact: "HIGH",
               vulnIntegrityImpact: "HIGH",
               vulnerabilityResponseEffort: "NOT_DEFINED",
            },
            source: "sirt@juniper.net",
            type: "Primary",
         },
      ],
   },
   published: "2024-07-11T16:15:03.210",
   references: [
      {
         source: "sirt@juniper.net",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://supportportal.juniper.net/JSA82975",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Vendor Advisory",
         ],
         url: "https://supportportal.juniper.net/JSA82975",
      },
   ],
   sourceIdentifier: "sirt@juniper.net",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-78",
            },
         ],
         source: "sirt@juniper.net",
         type: "Secondary",
      },
      {
         description: [
            {
               lang: "en",
               value: "CWE-78",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.