CVE-2024-39563 Junos Space: Remote Command Execution (RCE) vulnerability in web application
Unauthenticated attackers can execute arbitrary shell commands on Junos Space appliances via crafted GET requests, gaining full device control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-39563?
CVE-2024-39563 is a medium-severity command injection vulnerability in Juniper Junos Space, published on 11 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Command Injection vulnerability in Juniper Networks Junos Space allows an unauthenticated, network-based attacker sending a specially crafted request to execute arbitrary shell commands on the Junos Space Appliance, leading to remote command execution by the web application, gaining complete control of the device.
A specific script in the Junos Space web application allows attacker-controlled input from a GET request without sufficient input sanitization. A specially crafted request can exploit this vulnerability to execute arbitrary shell commands on the Junos Space Appliance.
This issue affects Junos Space 24.1R1. Previous versions of Junos Space are unaffected by this vulnerability.
Weakness: CWE-77
Which versions are affected by CVE-2024-39563?
It affects 1 product.
Products include Juniper Junos Space.
How do I fix CVE-2024-39563?
No fix has been published for CVE-2024-39563 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-39563 being exploited?
There is no known exploitation of CVE-2024-39563 in the wild and no public exploit code.
Other vulnerabilities in Juniper Junos Space
Sources
Also known as GHSA-h73h-rm47-56f4.