Junos OS: unsigned Python op scripts let a low-privileged user execute as root

Impact

When a device is configured to permit unsigned Python op scripts, a non-root Junos user can run an op script that executes with root-equivalent privileges, giving them full control of the switch or router. For an operator this converts every low-privilege network account - NOC read-only logins, automation service accounts, a contractor's operator role - into an administrator on the box. On fabric and management switches that means the attacker can rewrite forwarding and ACL state that separates tenants, and can install persistence on a device that is rarely reimaged. Exploitation needs the unsigned-script configuration to be present, which is a deliberate setting and a useful thing to audit first.

Who can reach it

Local, low-privileged authenticated user on the Junos CLI. Requires the device configuration to allow unsigned Python op scripts; without that configuration the path does not exist.

What to do

Upgrade Junos OS to 22.4R3-S7, 23.2R2-S4, 23.4R2-S6, 24.2R1-S2/24.2R2 or 24.4R1-S2/24.4R2, and Junos OS Evolved to 22.4R3-S7-EVO, 23.2R2-S4-EVO, 23.4R2-S6-EVO, 24.2R2-EVO or 24.4R1-S1-EVO/24.4R2-EVO, per your train. The effective interim mitigation is configuration, not patching: stop allowing unsigned op scripts and require signed ones, which takes a commit rather than a reboot. The upgrade itself is a device reload, so plan it around path redundancy.

References

Related entries

• Intel Ethernet Adapter manageability firmware (access control): Improper access control in Intel Ethernet adapterCVE-2021-33162 · Intel Ethernet Adapter manageability firmware (access control)High
• Crypto API Toolkit for Intel SGX: Improper access control in the SGX Crypto API Toolkit lets an authenticated userCVE-2022-21163 · Crypto API Toolkit for Intel SGXHigh
• HPE iLO 5 (local privilege escalation to code execution): An unprivileged user can execute arbitrary code in the iLOCVE-2022-28627 · HPE iLO 5 (local privilege escalation to code execution)High
• Phoenix SecureCore Technology 4 (SMI handler, improper access control): An SMI handler with missing access control letsCVE-2023-31100 · Phoenix SecureCore Technology 4 (SMI handler, improper access control)High
• AMD Secure Processor - XGMI Trusted Agent (type confusion): Type confusion in the ASP's XGMI Trusted Agent means aCVE-2023-31323 · AMD Secure Processor - XGMI Trusted Agent (type confusion)High
• Dell SmartFabric OS10 (hard-coded password): A hard-coded password in OS10 10.5.6.x gives an unauthenticated attackerCVE-2024-48831 · Dell SmartFabric OS10 (hard-coded password)High