CVE-2024-21591: Juniper Junos RCE Vulnerability

CVE-2024-21591 Overview

CVE-2024-21591 is an Out-of-bounds Write vulnerability affecting the J-Web interface of Juniper Networks Junos OS on SRX Series firewalls and EX Series switches. This vulnerability allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS) condition or achieve Remote Code Execution (RCE) with root privileges on the affected device.

The vulnerability stems from the use of an insecure function within the J-Web component that allows an attacker to overwrite arbitrary memory locations. Given that Juniper SRX and EX series devices are commonly deployed as perimeter security devices and enterprise switches, successful exploitation could have devastating consequences for network security infrastructure.

Critical Impact

Unauthenticated attackers can exploit this vulnerability remotely to gain root-level access on Juniper SRX and EX series devices, potentially compromising entire network perimeters.

Affected Products

• Juniper Networks Junos OS versions earlier than 20.4R3-S9 on SRX Series and EX Series
• Juniper Networks Junos OS 21.2 versions earlier than 21.2R3-S7 on SRX Series and EX Series
• Juniper Networks Junos OS 21.3 versions earlier than 21.3R3-S5 on SRX Series and EX Series
• Juniper Networks Junos OS 21.4 versions earlier than 21.4R3-S5 on SRX Series and EX Series
• Juniper Networks Junos OS 22.1 versions earlier than 22.1R3-S4 on SRX Series and EX Series
• Juniper Networks Junos OS 22.2 versions earlier than 22.2R3-S3 on SRX Series and EX Series
• Juniper Networks Junos OS 22.3 versions earlier than 22.3R3-S2 on SRX Series and EX Series
• Juniper Networks Junos OS 22.4 versions earlier than 22.4R2-S2 or 22.4R3 on SRX Series and EX Series

Discovery Timeline

• January 12, 2024 - CVE-2024-21591 published to NVD
• May 5, 2025 - Last updated in NVD database

Technical Details for CVE-2024-21591

Vulnerability Analysis

This vulnerability is classified as CWE-787 (Out-of-bounds Write), a memory corruption vulnerability that occurs when the J-Web interface processes attacker-controlled input. The vulnerability exists because the J-Web component utilizes an insecure function that fails to properly validate memory boundaries before performing write operations.

When exploited, an attacker can overwrite arbitrary memory locations within the affected process. This memory corruption can be leveraged to achieve two primary outcomes: crashing the J-Web service (causing a Denial of Service) or achieving controlled code execution with root privileges. The fact that successful exploitation grants root-level access makes this vulnerability particularly severe, as attackers gain complete control over the affected network device.

The attack requires no authentication and can be launched remotely over the network, making internet-exposed J-Web interfaces especially vulnerable. Given that SRX Series devices are typically deployed as perimeter firewalls and EX Series as enterprise switches, compromised devices could serve as pivot points for further network intrusion.

Root Cause

The root cause of CVE-2024-21591 is the use of an insecure function within the J-Web interface that allows memory writes without proper boundary checking. This unsafe memory handling permits an attacker to write data beyond the allocated buffer boundaries, corrupting adjacent memory structures.

The insecure function fails to validate that the destination buffer has sufficient capacity for the data being written. When processing maliciously crafted input, the function writes beyond the intended memory region, enabling arbitrary memory modification. This class of vulnerability typically arises from the use of legacy C library functions that do not perform bounds checking.

Attack Vector

The attack vector is network-based, targeting the J-Web management interface of affected Juniper devices. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the J-Web interface without requiring any authentication credentials.

The exploitation flow involves the attacker crafting malicious input designed to trigger the out-of-bounds write condition. By carefully controlling the data being written and the memory location being overwritten, an attacker can corrupt function pointers, return addresses, or other critical data structures. This memory corruption can then be leveraged to redirect program execution to attacker-controlled code, ultimately achieving remote code execution with root privileges.

The vulnerability can be exploited by any network-connected attacker who can reach the J-Web interface, whether through direct internet exposure or from within a compromised network segment.

Detection Methods for CVE-2024-21591

Indicators of Compromise

• Unexpected crashes or restarts of the J-Web service on SRX or EX series devices
• Anomalous HTTP requests targeting the J-Web interface with oversized or malformed parameters
• Unauthorized processes running with root privileges on affected Juniper devices
• Suspicious outbound network connections originating from Juniper management interfaces

Detection Strategies

• Monitor HTTP access logs for the J-Web interface for unusual request patterns, particularly requests with abnormally large payloads or unexpected parameters
• Implement network intrusion detection rules to identify exploitation attempts targeting Juniper J-Web interfaces
• Deploy web application firewall rules to block potentially malicious requests to J-Web management URLs
• Configure alerting on J-Web service crashes or unexpected process terminations

Monitoring Recommendations

• Enable comprehensive logging on all Juniper SRX and EX series devices with J-Web enabled
• Implement network traffic analysis to detect anomalous connections to device management interfaces
• Configure SIEM correlation rules to identify potential exploitation patterns across multiple devices
• Regularly audit device configurations and running processes for signs of compromise

How to Mitigate CVE-2024-21591

Immediate Actions Required

• Identify all Juniper SRX and EX series devices in your environment running vulnerable Junos OS versions
• Disable the J-Web interface on affected devices if not operationally required using the command delete system services web-management
• Restrict network access to J-Web interfaces using firewall rules or access control lists to limit exposure to trusted management networks only
• Apply available security patches from Juniper Networks as soon as possible

Patch Information

Juniper Networks has released security patches addressing this vulnerability. Organizations should upgrade to the following fixed versions based on their current Junos OS branch:

• Junos OS 20.4R3-S9 or later
• Junos OS 21.2R3-S7 or later
• Junos OS 21.3R3-S5 or later
• Junos OS 21.4R3-S5 or later
• Junos OS 22.1R3-S4 or later
• Junos OS 22.2R3-S3 or later
• Junos OS 22.3R3-S2 or later
• Junos OS 22.4R2-S2 or 22.4R3 or later

For detailed patch information and download links, refer to the Juniper Support Advisory JSA75729.

Workarounds

• Disable J-Web entirely if web-based management is not required for operational purposes
• Implement strict access control lists (ACLs) to limit J-Web access to specific trusted management IP addresses or networks only
• Use alternative management methods such as CLI over SSH or Junos Space for device administration
• Deploy a VPN or jump host architecture to ensure J-Web is never directly exposed to untrusted networks

# Disable J-Web interface on Juniper devices
configure
delete system services web-management
commit

# Alternative: Restrict J-Web access to specific management network
configure
set system services web-management https interface fxp0.0
set firewall filter MGMT-ACCESS term ALLOW-JWEB from source-address 10.0.0.0/24
set firewall filter MGMT-ACCESS term ALLOW-JWEB from protocol tcp
set firewall filter MGMT-ACCESS term ALLOW-JWEB from destination-port 443
set firewall filter MGMT-ACCESS term ALLOW-JWEB then accept
set firewall filter MGMT-ACCESS term DENY-ALL then discard
set interfaces fxp0 unit 0 family inet filter input MGMT-ACCESS
commit