CVE-2024-47507: Juniper Junos BGP DOS Vulnerability

CVE-2024-47507 Overview

CVE-2024-47507 is an Improper Check for Unusual or Exceptional Conditions vulnerability [CWE-754] affecting the routing protocol daemon (rpd) in Juniper Networks Junos OS and Junos OS Evolved. The flaw allows an unauthenticated, network-based attacker to send a Border Gateway Protocol (BGP) update message containing an aggregator attribute with an Autonomous System Number (ASN) value of zero. The rpd daemon accepts this malformed attribute and propagates it downstream, causing integrity issues on receiving BGP peers.

Critical Impact
A malicious or misconfigured BGP peer can inject a zero-ASN aggregator attribute that Junos propagates through the routing fabric, disrupting downstream BGP sessions and route processing across peered networks.

Affected Products

Juniper Junos OS: all versions before 21.4R3-S6, 22.2 versions before 22.2R3-S3, and 22.4 versions before 22.4R3
Juniper Junos OS Evolved: all versions before 21.4R3-S7-EVO, 22.2 versions before 22.2R3-S4-EVO, and 22.4 versions before 22.4R3-EVO
Devices running BGP with external peering sessions on the above releases

Discovery Timeline

2024-10-11 - CVE-2024-47507 published to NVD by Juniper Networks in advisory JSA88138
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-47507

Vulnerability Analysis

The vulnerability resides in the routing protocol daemon (rpd), which handles BGP message processing on Junos platforms. When a peer transmits a BGP UPDATE message containing the AGGREGATOR path attribute, rpd does not validate that the ASN portion of that attribute is non-zero. RFC 6793 and RFC 7607 explicitly prohibit an ASN of zero in BGP protocol fields. By accepting and re-advertising the attribute unchanged, Junos violates protocol expectations and forwards a malformed update into the peering mesh.

Downstream routers that correctly enforce RFC 7607 may treat the received UPDATE as malformed, tear down the BGP session, or reset the affected address-family adjacency. Repeated propagation can trigger route churn and partial route table loss for peered networks.

Root Cause

The root cause is missing validation of the AGGREGATOR attribute's ASN field during BGP UPDATE parsing in rpd. The daemon fails to enforce the constraint that ASN values must be non-zero, allowing the invalid attribute to pass through the ingress policy engine and enter the local RIB for re-advertisement.

Attack Vector

Exploitation requires no authentication beyond an established BGP session with the vulnerable Junos device. An attacker controlling an upstream BGP speaker, or a compromised peer, crafts a BGP UPDATE containing the AGGREGATOR attribute with the ASN field set to zero. Once accepted by the Junos rpd process, the malformed attribute propagates to every configured BGP neighbor that would otherwise receive the affected prefix, extending the integrity impact beyond the initially targeted router.

No verified public proof-of-concept exists for this issue. Refer to the Juniper Security Advisory JSA88138 for vendor-supplied technical details.

Detection Methods for CVE-2024-47507

Indicators of Compromise

BGP UPDATE messages logged by rpd containing an AGGREGATOR attribute with ASN value 0
Unexpected BGP session resets or NOTIFICATION messages referencing malformed OPTIONAL_TRANSITIVE attributes on downstream peers
Route churn or intermittent prefix withdrawals originating from a specific ingress peer

Detection Strategies

Enable BGP trace options on rpd to capture inbound UPDATE messages and inspect the AGGREGATOR attribute for zero-ASN values
Collect BGP telemetry via BMP (BGP Monitoring Protocol) and query for AGGREGATOR ASN equal to 0 across all peers
Correlate rpd syslog events with downstream peer session flaps to identify the propagating device

Monitoring Recommendations

Continuously monitor BGP session state changes on all edge routers and alert on repeated flaps from the same neighbor
Ingest routing telemetry and syslog data into a centralized analytics platform to identify anomalous path attribute patterns
Track Junos OS version inventory to identify unpatched devices exposed to external BGP peers

How to Mitigate CVE-2024-47507

Immediate Actions Required

Upgrade Junos OS to 21.4R3-S6, 22.2R3-S3, 22.4R3, or later fixed releases
Upgrade Junos OS Evolved to 21.4R3-S7-EVO, 22.2R3-S4-EVO, 22.4R3-EVO, or later fixed releases
Audit BGP peering relationships and restrict which peers can advertise transitive path attributes

Patch Information

Juniper Networks addresses CVE-2024-47507 in the fixed releases listed above. Full remediation details are available in the Juniper Security Advisory JSA88138. Operators running End-of-Engineering releases should upgrade to a supported branch prior to applying the fix.

Workarounds

Configure a BGP import policy that rejects or strips the AGGREGATOR attribute when the ASN value is 0
Apply a policy-statement on ingress to filter UPDATE messages containing malformed path attributes from untrusted peers
Where feasible, enable BGP enforce-first-as and tighten peer prefix limits to reduce the blast radius of a hostile neighbor

bash

# Example Junos import policy sketch to discard routes carrying a zero-ASN aggregator
set policy-options policy-statement REJECT-ZERO-AGGREGATOR term drop-zero-asn from aggregator as 0
set policy-options policy-statement REJECT-ZERO-AGGREGATOR term drop-zero-asn then reject
set protocols bgp group EXTERNAL import REJECT-ZERO-AGGREGATOR
commit check