Critical Vulnerability Present in Junos OS SRX and EX Series Devices

Summary

A critical 9.3 CVSS 4.0 vulnerability has been discovered in Junos OS J-Web interface on SRX series firewall and EX series switches. Identified as CVE-2024-21591, this out-of-bounds write vulnerability impacts the J-Web interface of affected operating systems. The vulnerability is caused by an insecure function that allows an attacker to overwrite arbitrary memory. An unauthenticated, network-bound hacker can cause a Denial of Service (DoS) or Remote Code Execution (RCE) on the device to obtain root privileges. Juniper SIRT is not aware of any malicious exploitation of this vulnerability.

Impact Assessment

An attacker can perform a RCE or DoS remotely with no authentication or user interaction. If exploited, a complete loss of confidentiality, integrity, and availability could ensue. For these reasons, the impact of the vulnerability has been designated High .

This issue affects Juniper Networks Junos OS SRX Series and EX Series.

1. Junos OS versions earlier than 20.4R3-S9;
2. Junos OS 21.2 versions earlier than 21.2R3-S7;
3. Junos OS 21.3 versions earlier than 21.3R3-S5;
4. Junos OS 21.4 versions earlier than 21.4R3-S5;
5. Junos OS 22.1 versions earlier than 22.1R3-S4;
6. Junos OS 22.2 versions earlier than 22.2R3-S3;
7. Junos OS 22.3 versions earlier than 22.3R3-S2;
8. Junos OS 22.4 versions earlier than 22.4R2-S2, 22.4R3.
9. Juniper has also indicated that the following minimal configuration must be present on the device:

[system services web-management http]

or

[system services web-management https]

What It Means for You

Review your hardware inventory for any Juniper Networks SRX or EX series firewalls and switches. If you have any of these devices, review the software versions and if they are out of date update accordingly.

Remediation

The following software releases have been updated to resolve this specific issue:

Junos OS: 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S3, 22.3R3-S2, 22.4R2-S2, 22.4R3, 23.2R1-S1, 23.2R2, 23.4R1, and all subsequent releases.

Updating to one of the above versions will remediate the vulnerability.

There is a workaround which involves disabling J-Web or limiting access to only trusted host.

Business Implications

An attack that exploits this vulnerability could enable lateral movement or privilege escalation and therefore could be disastrous for any organization.

Access Point Technology Recommends

1. Update: An update is available for this critical vulnerability. Patch your Junos OS Firewall and/or switch as soon as possible.
2. Harden Network: Having redundancy and proper network segmentation, including a demilitarized zone within the network infrastructure can help prevent lateral movement.

Follow vendor recommendations: The vendor has provided a solution and multiple workarounds to this vulnerability. Follow vendor recommendations for remediation efforts.

Associated Bulletins

https://supportportal.juniper.net/s/article/2024-01-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Security-Vulnerability-in-J-web-allows-a-preAuth-Remote-Code-Execution-CVE-2024-21591?language=en_US

https://www.cve.org/CVERecord?id=CVE-2024-21591

‍