Juniper Junos OS up to 21.3R1-S2 on MX/SRX Packet Forwarding Engine missing authentication

Summaryinfo

A vulnerability was found in Juniper Junos OS up to 21.3R1-S2 on MX/SRX. It has been rated as critical. Affected by this issue is some unknown functionality of the component Packet Forwarding Engine. Performing a manipulation results in missing authentication. This vulnerability is reported as CVE-2024-30391. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Juniper Junos OS up to 21.3R1-S2 on MX/SRX. It has been classified as critical. This affects an unknown function of the component Packet Forwarding Engine. The manipulation with an unknown input leads to a missing authentication vulnerability. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on integrity, and availability. The summary by CVE is:

A Missing Authentication for Critical Function vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on MX Series with SPC3, and SRX Series allows an unauthenticated network-based attacker to cause limited impact to the integrity or availability of the device. If a device is configured with IPsec authentication algorithm hmac-sha-384 or hmac-sha-512, tunnels are established normally but for traffic traversing the tunnel no authentication information is sent with the encrypted data on egress, and no authentication information is expected on ingress. So if the peer is an unaffected device transit traffic is going to fail in both directions. If the peer is an also affected device transit traffic works, but without authentication, and configuration and CLI operational commands indicate authentication is performed. This issue affects Junos OS: All versions before 20.4R3-S7, 21.1 versions before 21.1R3,  21.2 versions before 21.2R2-S1, 21.2R3,  21.3 versions before 21.3R1-S2, 21.3R2.

It is possible to read the advisory at supportportal.juniper.net. This vulnerability is uniquely identified as CVE-2024-30391 since 03/26/2024. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 310771 (Juniper Junos OS Vulnerability (JSA79188)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 20.4R3-S7, 21.1R3, 21.2R2-S1, 21.2R3, 21.3R1-S2 or 21.3R2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (310771). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

Version

• 20.4R3-S6
• 21.1R2
• 21.2R2
• 21.2R2-S1
• 21.3R1
• 21.3R1-S2

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion