Multiple Juniper Networks Flaw Let Attackers Delete Files

The Juniper networks-owned Junos OS has been realized to have extra than one vulnerabilities linked to Denial of Provider (DoS), Path Traversal, and Unpleasant-Put Scripting (XSS).

The CVEs for these vulnerabilities have been assigned with CVE-2024-30409, CVE-2020-1606, and CVE-2020-1607.

The severity for these vulnerabilities ranges between 5.3 (Medium) to 7.5 (High). On the other hand, these vulnerabilities have been patched by Juniper networks, and linked safety advisories have been printed to address them.

Vulnerability Significant beneficial properties

Per the advisory released, the DoS used to be known ensuing from Greater CPU consumption on the routing engine, the route traversal, and the spoiled-plight scripting vulnerabilities that existed in the J-Net Interface and Junos OS.

These vulnerabilities impact extra than one Juniper network products and variations.

CVE-2024-30409 : Greater CPU consumption On Routing Rngine Leads To Denial Of Provider

This vulnerability exists in extra than one variations of Junos OS and JunosOS developed ensuing from unfriendly take a look at for abnormal or distinctive prerequisites in the telemetry processing.

This vulnerability permits an authenticated network-essentially essentially based attacker to cause a denial of carrier situation by crashing the ahead info sinful telemetry daemon (fibtd).

The severity for this vulnerability used to be given as 5.3 (Medium) in step with CVSS v3 rating and 6.9 (Medium) as per CVSS v4 rating.

Furthermore, this vulnerability is seen when the telemetry subscription is sharp and Fib-streaming is enabled.

No workarounds were mentioned to mitigate this vulnerability.

CVE-2020-1606: Path Traversal Vulnerability In J-Net

This vulnerability exists in the Junos OS devices, which can presumably per chance allow an authenticated attacker with J-internet client privilege to learn or delete recordsdata with “world” readable and writable permissions.

On the other hand, without root client privilege, this vulnerability can not have vital impact on diagram recordsdata.

As a workaround, customers of affected Junos OS variations can restrict the entry to J-internet interface to handiest relied on customers for reducing the exploitation possibility.

On the other hand, as a prerequisite, the J-internet interface ought to be enabled on the affected tool.

CVE-2020-1607: Unpleasant-Put Scripting (XSS) In J-Net

This vulnerability exists ensuing from insufficient XSS safety in the J-internet interface, which can presumably per chance allow a possibility actor to inject internet script or HTML.

This script injection can potentially outcome in hijacking of client’s or administrator’s J-Net session that will also be faded to create administrative action on the Junos OS under the impact of the targeted client.

As a workaround for this vulnerability, customers will also be attach aside to entry the J-internet carrier handiest from relied on sources corresponding to jumphosts and not using a info superhighway entry.

Alternatively, the J-internet interface can moreover be disabled.

Affected Merchandise And Fastened In Variations

Users of these Junos OS and Junos OS developed products are urged to toughen to the most modern variations in portray to forestall the exploitation of these vulnerabilities by possibility actors.