Junos Space Command Injection Vulnerability Allows Remote Command Execution

CVE-2024-39563

Summary

A Command Injection vulnerability exists in Juniper Networks' Junos Space, enabling unauthenticated, network-based attackers to send specially crafted requests that result in the execution of arbitrary shell commands on the Junos Space Appliance. The issue arises from inadequate input sanitization in a specific script within the web application, allowing malicious input passed via a GET request. Exploitation of this vulnerability can lead to remote command execution, potentially granting the attacker full control over the affected device. Only Junos Space version 24.1R1 is impacted, while earlier versions remain unaffected.

References