CVE-2024-47499: Juniper Junos DOS Vulnerability

CVE-2024-47499 Overview

CVE-2024-47499 is an Improper Check for Unusual or Exceptional Conditions vulnerability [CWE-754] in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved. An unauthenticated, network-based attacker can trigger a Denial of Service (DoS) by sending a BGP update with a malformed AS PATH attribute over an established BGP session. The condition is only reachable when BGP Monitoring Protocol (BMP) is configured with rib-in pre-policy monitoring. Successful exploitation crashes the rpd process and forces a restart, disrupting routing on the affected device.

Critical Impact
A single malformed BGP update can crash the Junos routing daemon, interrupting routing operations on core and edge devices running vulnerable Junos OS or Junos OS Evolved releases with BMP rib-in pre-policy monitoring enabled.

Affected Products

Juniper Junos OS: all versions before 21.2R3-S8; 21.4 before 21.4R3-S8; 22.2 before 22.2R3-S4; 22.3 before 22.3R3-S3; 22.4 before 22.4R3-S2; 23.2 before 23.2R2-S1; 23.4 before 23.4R1-S2 and 23.4R2
Juniper Junos OS Evolved: all versions before 21.2R3-S8-EVO; 21.4 before 21.4R3-S8-EVO; 22.2 before 22.2R3-S4-EVO; 22.3 before 22.3R3-S3-EVO; 22.4 before 22.4R3-S2-EVO; 23.2 before 23.2R2-S1-EVO; 23.4 before 23.4R1-S2-EVO and 23.4R2-EVO
Routing Protocol Daemon (rpd) component with BGP Monitoring Protocol (BMP) rib-in pre-policy monitoring configured

Discovery Timeline

2024-10-11 - CVE-2024-47499 published to NVD with Juniper Security Advisory JSA88129
2026-01-26 - Last updated in NVD database

Technical Details for CVE-2024-47499

Vulnerability Analysis

The Routing Protocol Daemon (rpd) is the central process responsible for handling routing protocols, including BGP, on Junos OS and Junos OS Evolved. When BGP Monitoring Protocol (BMP) is configured with rib-in pre-policy monitoring, rpd exports received BGP routes to a BMP collector before any import policy is applied. The vulnerability resides in how this path processes the AS PATH attribute carried in incoming BGP updates.

A specifically malformed AS PATH attribute is not properly validated against unusual or exceptional conditions during the BMP pre-policy export. This causes rpd to crash and restart, dropping all BGP sessions and pausing routing convergence until the daemon recovers. Repeated malformed updates can produce a sustained outage.

Root Cause

The root cause is classified under [CWE-754] — Improper Check for Unusual or Exceptional Conditions. The rpd code path that prepares BGP routes for BMP rib-in pre-policy monitoring fails to validate edge cases in the AS PATH attribute before processing, leading to an unhandled exception inside the daemon.

Attack Vector

Exploitation requires an established BGP session between the attacker-controlled or attacker-influenced peer and the vulnerable Junos device. Once the session is up, the attacker sends a BGP UPDATE message containing a specially crafted AS PATH attribute. If the receiving device has BMP configured with rib-in pre-policy monitoring, processing the update triggers an rpd crash. No authentication beyond the standard BGP peering relationship is required, and no user interaction is needed. The attack is purely network-based and impacts availability only — confidentiality and integrity are unaffected.

No public proof-of-concept or in-the-wild exploitation has been reported. Refer to the Juniper Security Advisory JSA88129 for additional protocol-level details.

Detection Methods for CVE-2024-47499

Indicators of Compromise

Unexpected rpd process crashes or restarts on Junos devices with BMP rib-in pre-policy monitoring configured
BGP sessions flapping or resetting simultaneously across multiple peers without an underlying network event
Core files generated by rpd shortly after receipt of BGP UPDATE messages from a specific peer

Detection Strategies

Inspect device syslog and chassis logs for RPD_TASK_REINIT, rpd core, or daemon restart messages correlated with BGP UPDATE activity
Audit running configurations for protocols bmp stanzas with rib-in pre-policy enabled to identify exposure scope
Correlate BGP session resets against ingress UPDATE traffic from each peer to localize the malicious source

Monitoring Recommendations

Forward Junos syslog, BGP state changes, and rpd core notifications to a centralized SIEM for correlation
Alert on repeated rpd restarts within short time windows across BGP-speaking devices
Track BMP collector connectivity gaps as a secondary signal of routing daemon instability

How to Mitigate CVE-2024-47499

Immediate Actions Required

Upgrade affected Junos OS and Junos OS Evolved devices to a fixed release identified in Juniper Security Advisory JSA88129
Inventory devices with BMP rib-in pre-policy monitoring enabled and prioritize them for patching
Restrict BGP peering to trusted ASNs and apply strict ingress route filtering at the network edge

Patch Information

Juniper has released fixed software in Junos OS 21.2R3-S8, 21.4R3-S8, 22.2R3-S4, 22.3R3-S3, 22.4R3-S2, 23.2R2-S1, 23.4R1-S2, 23.4R2, and subsequent releases. Equivalent Junos OS Evolved fixes are available in 21.2R3-S8-EVO, 21.4R3-S8-EVO, 22.2R3-S4-EVO, 22.3R3-S3-EVO, 22.4R3-S2-EVO, 23.2R2-S1-EVO, 23.4R1-S2-EVO, and 23.4R2-EVO. Full version details are documented in Juniper Security Advisory JSA88129.

Workarounds

Disable BMP rib-in pre-policy monitoring on affected devices until patches can be applied, since the vulnerability is only triggered in that configuration
Apply BGP import policies and inbound AS PATH filters that reject updates from untrusted sources or with anomalous AS PATH structures
Limit BGP peering to authenticated, trusted neighbors and segment BMP collectors on a protected management network

bash

# Configuration example: remove BMP rib-in pre-policy monitoring as a temporary workaround
configure
delete protocols bmp station <station-name> route-monitoring pre-policy
commit and-quit

# Verify rpd stability and active BMP configuration
show system processes extensive | match rpd
show bmp