CVE-2024-21619: Juniper Junos Information Disclosure Flaw

CVE-2024-21619 Overview

CVE-2024-21619 is a Missing Authentication for Critical Function vulnerability combined with a Generation of Error Message Containing Sensitive Information vulnerability affecting the J-Web interface of Juniper Networks Junos OS on SRX Series firewalls and EX Series switches. This vulnerability allows an unauthenticated, network-based attacker to access sensitive system configuration information without requiring any credentials.

The vulnerability exploits a flaw in how J-Web handles temporary configuration files. When a user logs into the J-Web interface, the system creates a temporary file in the /cache folder containing the device configuration visible to that user. An unauthenticated attacker can attempt to access these files by sending specially crafted requests to the device, attempting to guess the filename pattern of these cached configuration files.

Critical Impact

Successful exploitation enables unauthenticated attackers to retrieve device configuration data from Juniper SRX and EX Series devices, potentially exposing network topology, security policies, credentials, and other sensitive infrastructure information.

Affected Products

• Juniper Networks Junos OS on SRX Series (all versions earlier than 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R1-S2/23.2R2)
• Juniper Networks Junos OS on EX Series (all versions earlier than 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R3, 23.2R1-S2/23.2R2)
• Multiple SRX Series models including SRX100, SRX300, SRX1500, SRX4100, SRX5000, and SRX5800
• Multiple EX Series models including EX2200, EX2300, EX3400, EX4300, EX4600, and EX9200

Discovery Timeline

• 2024-01-25 - CVE-2024-21619 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-21619

Vulnerability Analysis

This vulnerability results from two distinct security weaknesses working in combination: a missing authentication check on critical functionality (CWE-306) and the generation of error messages containing sensitive information (CWE-209). The J-Web management interface, which provides web-based administration for Junos OS devices, fails to properly protect access to temporary configuration cache files.

When administrators or users authenticate to J-Web, the system generates temporary files containing device configuration data. These files are stored in a predictable location (/cache folder) with filenames that can potentially be guessed or enumerated. The fundamental issue is that accessing these cached files does not require authentication, creating an avenue for information disclosure.

The impact is significant because device configurations often contain sensitive data including routing protocols, firewall rules, VPN configurations, user accounts, and potentially credentials or API keys embedded in configuration snippets. An attacker who obtains this information can map network architecture, identify security controls, and plan further attacks against the infrastructure.

Root Cause

The root cause stems from inadequate access control implementation in the J-Web file serving mechanism. The application fails to verify that requests for cached configuration files originate from authenticated sessions. This missing authentication check, combined with the practice of storing sensitive configuration data in temporary files with predictable naming conventions, creates the exploitation path.

The vulnerability is compounded by overly verbose error handling that may leak information about file existence or naming patterns, aiding attackers in their enumeration efforts.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to the J-Web interface (typically on TCP port 443 or a configured management port) can exploit this vulnerability by:

1. Identifying a target Juniper SRX or EX Series device running J-Web
2. Sending HTTP/HTTPS requests attempting to access files in the /cache directory
3. Enumerating or guessing temporary filename patterns used by the application
4. Retrieving configuration files that were generated during legitimate user sessions

The attack surface is particularly concerning for devices with J-Web exposed to untrusted networks or the internet. Even on internal networks, this vulnerability could be exploited by malicious insiders or attackers who have gained initial network access through other means.

Detection Methods for CVE-2024-21619

Indicators of Compromise

• Unusual HTTP/HTTPS requests targeting the /cache directory or path traversal attempts on J-Web interfaces
• Multiple failed or successful requests for files with randomized or sequential naming patterns in web server logs
• Access to configuration cache files from IP addresses that did not recently authenticate to J-Web
• Unexpected spikes in web traffic to Juniper device management interfaces

Detection Strategies

• Monitor J-Web access logs for requests targeting cache directories or temporary file paths
• Implement network-based detection rules for HTTP requests containing /cache/ or similar path patterns directed at Juniper device IPs
• Correlate file access events with authentication logs to identify unauthenticated access attempts
• Deploy intrusion detection signatures that alert on reconnaissance patterns against J-Web interfaces

Monitoring Recommendations

• Enable comprehensive logging on J-Web interfaces and forward logs to a centralized SIEM platform
• Establish baseline metrics for J-Web traffic patterns and alert on anomalies
• Monitor for connections from unexpected source IP addresses to management interfaces
• Review authentication logs regularly for signs of session exploitation or token manipulation

How to Mitigate CVE-2024-21619

Immediate Actions Required

• Upgrade affected Juniper Junos OS systems to patched versions as specified in the security advisory
• Restrict J-Web access to trusted management networks only using firewall rules or access control lists
• Disable J-Web entirely if web-based management is not required for operations
• Review device configurations for sensitive information that may have been exposed

Patch Information

Juniper Networks has released patched versions of Junos OS that address this vulnerability. The following minimum versions should be applied based on your current release train:

• Version 20.4: Upgrade to 20.4R3-S9 or later
• Version 21.2: Upgrade to 21.2R3-S7 or later
• Version 21.3: Upgrade to 21.3R3-S5 or later
• Version 21.4: Upgrade to 21.4R3-S6 or later
• Version 22.1: Upgrade to 22.1R3-S5 or later
• Version 22.2: Upgrade to 22.2R3-S3 or later
• Version 22.3: Upgrade to 22.3R3-S2 or later
• Version 22.4: Upgrade to 22.4R3 or later
• Version 23.2: Upgrade to 23.2R1-S2 or 23.2R2 or later

For detailed patch information and download links, refer to the Juniper Security Advisory JSA76390.

Workarounds

• Disable J-Web on affected devices if not operationally required using the CLI command to delete or deactivate the system services web-management configuration
• Implement strict access control lists (ACLs) limiting J-Web access to specific trusted management IP addresses or subnets
• Use out-of-band management networks isolated from production traffic for device administration
• Consider using alternative management methods such as CLI over SSH or NETCONF until patches can be applied

# Disable J-Web on Junos OS devices
configure
delete system services web-management
commit
exit

# Alternatively, restrict J-Web to specific management hosts
configure
set system services web-management management-instance
set system services web-management http interface fxp0.0
set system services web-management https interface fxp0.0
set system services web-management https local-certificate <cert-name>
set firewall filter MGMT-ACCESS term ALLOW-JWEB from source-address 10.0.0.0/24
set firewall filter MGMT-ACCESS term ALLOW-JWEB from protocol tcp
set firewall filter MGMT-ACCESS term ALLOW-JWEB from destination-port https
set firewall filter MGMT-ACCESS term ALLOW-JWEB then accept
set firewall filter MGMT-ACCESS term DENY-ALL then reject
commit