Juniper Junos OS Authentication for Critical Function (CVE-2024-21619)

#TRUSTED 4a2e16c4a709a81f52f3b20970f0a8eebde399a6bf8d2a49a91bb1d85a8dfb3507f91810d36374837ddae87ee7c7b609b3bab4d7833d9905f64faef937d89a4bb9259b0faf85fcc9b21ac34760f21dd9894ed838c21b365575f559e70bbc16a1367dc0fccd96df5e93c2e6eaebd81d950c4bf70f797eb7ee74fc4ab98fe79da41ec8cee4a7e56d6dceb8327449c595224e0f5a88b997c92a63f5512a2b8c8df190abdde5b59600ffeca9ec28b162ded3079f38a39ba135343abb78fcd90d279e83bfacec9eeee26798f1df4b797acaa81c7ba277fe5493b26ad9f8201091d118cceb9f34e2514ee7c9db006be3e75239b781a96db4a5efc505907157050e7eb0c29ddfe17b7764bbec59127c1da1d52be0540597f870805d11200addf06f72e5ff0f580d91c9ad768c29c1a2d79208dc74b344a6693f8964c4b8460903033f0fdb6e295fd4fabc37c684e2098074578c4c831f45283b341daca9576834eedb7668b12c7adaeb561e83be9828fabea880a9b90e27cf974808b11124e4999a9691d19ecafee7676f18cd8a3ded0919fdeea8d8843e57a10a4d543fdbfc3ef9c4ab800c442372e473d26e5ec03a3b3b3b15a89aefabefbaa357e396cd4120e7e4bd3ba63605af25dca89654c7c094c17407829d37bce512dc9ae5d138ec977260603641eebdb9b9fd1aaf50e57cfd65a2a079fc960ed44f9f5291c07427e7118d5f
#TRUST-RSA-SHA256 b0334e02097a4c989f2ca3adc1c8a2646c9829dfe14891a1e15016e5738e99d3412cff7253c7006749bdfad610b358dda771aef77b825922960967f0d0df4846c30a6ee21c860365b3e4dd12c832c10e8e45c7e468a55027e9b63f2e0aab6533b16f838218dc783f0230e8535c2f858214dcab749c8c49b0a63fa75ad85811729d35da1be4d7fee35ad8ea9d3c2cf49a2eb6c5fa1ac6699118c37f1f1602ac8fad3392d90cb2e30df98e8dd0776bdb5e74fe3b0babda1d6c808de4276be6a5b0035bdb4d1df814456214a6e6a94bb2f2c66bf7ec56ccc9d3ff76f3203954ccb2407ed073facef7b32ece16264d90e7a55c0564047d461fda4556d8251cf55b86424ec31e77cfb182866b63322be29c1a950d8a16cbdc469a51fcad8bc7268dc8c559e9fb7ae54bfb149bffe7fc3346cfc2b850fb7faef024f88551c47cf44f3304a980b5e4685e86930807517c3c46aab5ef0340492237c49964feacd55b9876a7dc0a610bbd7f5d17ac87c09e3efabc183491643b4fbc9672ebff6fc080e6bdd476d1ce118618b6d97b83edc24ed7a2117873e358ef8bc9923d90a013375e19b6b5938abe98b6f5cfd3abfe028908b42245892b5a89f328b418444e20c09f9a764b4a57c55e9d432da6ecb6b3bafece711a68b4ae8e55e7cf52286200cce8051817219bc9f15af500ee749b503eea68add402930439c830ae68b75e086ce864
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(215001);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/22");

  script_cve_id("CVE-2024-21619");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2023/11/17");
  script_xref(name:"JSA", value:"JSA76390");

  script_name(english:"Juniper Junos OS Authentication for Critical Function (CVE-2024-21619)");

  script_set_attribute(attribute:"synopsis", value:
"The remote device is missing a vendor-supplied security patch.");
  script_set_attribute(attribute:"description", value:
"The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the
JSA76390 advisory.

  - A Missing Authentication for Critical Function vulnerability combined with a Generation of Error Message
    Containing Sensitive Information vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX
    Series allows an unauthenticated, network-based attacker to access sensitive system information. When a
    user logs in, a temporary file which contains the configuration of the device (as visible to that user) is
    created in the /cache folder. An unauthenticated attacker can then attempt to access such a file by
    sending a specific request to the device trying to guess the name of such a file. Successful exploitation
    will reveal configuration information. (CVE-2024-21619)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://kb.juniper.net/JSA76390");
  script_set_attribute(attribute:"solution", value:
"Apply the relevant Junos software release referenced in Juniper advisory JSA76390");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"manual");
  script_set_attribute(attribute:"cvss_score_rationale", value:"Set to score from vendor advisory.");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/01/25");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/01/25");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/02/05");

  script_set_attribute(attribute:"plugin_type", value:"combined");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:juniper:junos");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Junos Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("junos_version.nasl");
  script_require_keys("Host/Juniper/JUNOS/Version", "Host/Juniper/model");

  exit(0);
}

include('junos.inc');
include('junos_kb_cmd_func.inc');

var ver = get_kb_item_or_exit('Host/Juniper/JUNOS/Version');
var model = get_kb_item_or_exit('Host/Juniper/model');

if (model !~ "^(EX|SRX)")
  audit(AUDIT_DEVICE_NOT_VULN, model);

var vuln_ranges = [
  {'min_ver':'0.0', 'fixed_ver':'20.4R3-S9', 'model':'^(EX|SRX)'},
  {'min_ver':'21.2', 'fixed_ver':'21.2R3-S7', 'model':'^(EX|SRX)'},
  {'min_ver':'21.3', 'fixed_ver':'21.3R3-S5', 'model':'^(EX|SRX)'},
  {'min_ver':'21.4', 'fixed_ver':'21.4R3-S6', 'model':'^(EX|SRX)'},
  {'min_ver':'22.1', 'fixed_ver':'22.1R3-S5', 'model':'^(EX|SRX)'},
  {'min_ver':'22.2', 'fixed_ver':'22.2R3-S3', 'model':'^(EX|SRX)'},
  {'min_ver':'22.3', 'fixed_ver':'22.3R3-S2', 'model':'^(EX|SRX)'},
  {'min_ver':'22.4', 'fixed_ver':'22.4R3', 'model':'^(EX|SRX)'},
  {'min_ver':'23.2', 'fixed_ver':'23.2R1-S2', 'fixed_display':'23.2R1-S2, 23.2R2, 23.4R1', 'model':'^(EX|SRX)'}
];

var override = TRUE;
var buf = junos_command_kb_item(cmd:"show configuration | display set");
if (!empty_or_null(buf))
{
  override = FALSE;
  if(!junos_check_config(buf:buf, pattern:"^set system services web-management http(s)?")) 
    audit(AUDIT_HOST_NOT, 'vulnerable as J-Web is not enabled');
}

var fix = junos_compare_range(target_version:ver, vuln_ranges:vuln_ranges);
if (empty_or_null(fix))
  audit(AUDIT_INST_VER_NOT_VULN, 'Junos OS', ver);
junos_report(ver:ver, fix:fix, override:override, severity:SECURITY_HOLE);