CVE-2021-31350: Junos OS and Junos OS Evolved: Privilege escalation vulnerability in Juniper Extension Toolkit (JET)
First published: Wed Oct 13 2021(Updated: )
An Improper Privilege Management vulnerability in the gRPC framework, used by the Juniper Extension Toolkit (JET) API on Juniper Networks Junos OS and Junos OS Evolved, allows a network-based, low-privileged authenticated attacker to perform operations as root, leading to complete compromise of the targeted system. The issue is caused by the JET service daemon (jsd) process authenticating the user, then passing configuration operations directly to the management daemon (mgd) process, which runs as root. This issue affects Juniper Networks Junos OS: 18.4 versions prior to 18.4R1-S8, 18.4R2-S8, 18.4R3-S8; 19.1 versions prior to 19.1R2-S3, 19.1R3-S5; 19.2 versions prior to 19.2R1-S7, 19.2R3-S2; 19.3 versions prior to 19.3R2-S6, 19.3R3-S2; 19.4 versions prior to 19.4R1-S4, 19.4R2-S4, 19.4R3-S3; 20.1 versions prior to 20.1R2-S2, 20.1R3; 20.2 versions prior to 20.2R2-S3, 20.2R3; 20.3 versions prior to 20.3R2-S1, 20.3R3; 20.4 versions prior to 20.4R2. This issue does not affect Juniper Networks Junos OS versions prior to 18.4R1. Juniper Networks Junos OS Evolved: All versions prior to 20.4R2-EVO; 21.1-EVO versions prior to 21.1R2-EVO.
Credit: sirt@juniper.net
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Junos OS Evolved | =18.4 | |
| Junos OS Evolved | =18.4-r1 | |
| Junos OS Evolved | =18.4-r1-s1 | |
| Junos OS Evolved | =18.4-r1-s2 | |
| Junos OS Evolved | =18.4-r1-s3 | |
| Junos OS Evolved | =18.4-r1-s4 | |
| Junos OS Evolved | =18.4-r1-s5 | |
| Junos OS Evolved | =18.4-r1-s6 | |
| Junos OS Evolved | =18.4-r1-s7 | |
| Junos OS Evolved | =18.4-r2-s8 | |
| Junos OS Evolved | =18.4-r3-s8 | |
| Junos OS Evolved | =19.1 | |
| Junos OS Evolved | =19.1-r1 | |
| Junos OS Evolved | =19.1-r1-s1 | |
| Junos OS Evolved | =19.1-r1-s2 | |
| Junos OS Evolved | =19.1-r1-s3 | |
| Junos OS Evolved | =19.1-r1-s4 | |
| Junos OS Evolved | =19.1-r1-s5 | |
| Junos OS Evolved | =19.1-r1-s6 | |
| Junos OS Evolved | =19.1-r2 | |
| Junos OS Evolved | =19.1-r2-s1 | |
| Junos OS Evolved | =19.1-r2-s2 | |
| Junos OS Evolved | =19.1-r3-s5 | |
| Junos OS Evolved | =19.2 | |
| Junos OS Evolved | =19.2-r1 | |
| Junos OS Evolved | =19.2-r1-s1 | |
| Junos OS Evolved | =19.2-r1-s2 | |
| Junos OS Evolved | =19.2-r1-s3 | |
| Junos OS Evolved | =19.2-r1-s4 | |
| Junos OS Evolved | =19.2-r1-s5 | |
| Junos OS Evolved | =19.2-r1-s6 | |
| Junos OS Evolved | =19.2-r3-s2 | |
| Junos OS Evolved | =19.3 | |
| Junos OS Evolved | =19.3-r1 | |
| Junos OS Evolved | =19.3-r1-s1 | |
| Junos OS Evolved | =19.3-r2 | |
| Junos OS Evolved | =19.3-r2-s1 | |
| Junos OS Evolved | =19.3-r2-s2 | |
| Junos OS Evolved | =19.3-r2-s3 | |
| Junos OS Evolved | =19.3-r2-s4 | |
| Junos OS Evolved | =19.3-r2-s5 | |
| Junos OS Evolved | =19.3-r3-s2 | |
| Junos OS Evolved | =19.4-r1 | |
| Junos OS Evolved | =19.4-r1-s1 | |
| Junos OS Evolved | =19.4-r1-s2 | |
| Junos OS Evolved | =19.4-r1-s3 | |
| Junos OS Evolved | =19.4-r2-s4 | |
| Junos OS Evolved | =19.4-r3-s3 | |
| Junos OS Evolved | =20.1-r1 | |
| Junos OS Evolved | =20.1-r1-s1 | |
| Junos OS Evolved | =20.1-r1-s2 | |
| Junos OS Evolved | =20.1-r1-s3 | |
| Junos OS Evolved | =20.1-r1-s4 | |
| Junos OS Evolved | =20.1-r2 | |
| Junos OS Evolved | =20.1-r2-s1 | |
| Junos OS Evolved | =20.1-r3 | |
| Junos OS Evolved | =20.2-r1 | |
| Junos OS Evolved | =20.2-r1-s1 | |
| Junos OS Evolved | =20.2-r1-s2 | |
| Junos OS Evolved | =20.2-r1-s3 | |
| Junos OS Evolved | =20.2-r2 | |
| Junos OS Evolved | =20.2-r2-s1 | |
| Junos OS Evolved | =20.2-r2-s2 | |
| Junos OS Evolved | =20.2-r3 | |
| Junos OS Evolved | =20.3-r1 | |
| Junos OS Evolved | =20.3-r1-s1 | |
| Junos OS Evolved | =20.3-r2 | |
| Junos OS Evolved | =20.3-r3 | |
| Junos OS Evolved | =20.4-r1 | |
| Junos OS Evolved | =20.4-r1-s1 | |
| Juniper JUNOS | =18.3-r1 | |
| Juniper JUNOS | =19.1-r1 | |
| Juniper JUNOS | =19.1-r2 | |
| Juniper JUNOS | =19.2-r1 | |
| Juniper JUNOS | =19.2-r2 | |
| Juniper JUNOS | =19.3-r1 | |
| Juniper JUNOS | =19.3-r2 | |
| Juniper JUNOS | =19.4-r1 | |
| Juniper JUNOS | =19.4-r1-s1 | |
| Juniper JUNOS | =20.1-r1 | |
| Juniper JUNOS | =20.1-r1-s1 | |
| Juniper JUNOS | =20.1-r2 | |
| Juniper JUNOS | =20.1-r2-s1 | |
| Juniper JUNOS | =20.1-r2-s2 | |
| Juniper JUNOS | =20.2-r1 | |
| Juniper JUNOS | =20.2-r1-s1 | |
| Juniper JUNOS | =20.2-r2 | |
| Juniper JUNOS | =20.3-r1 | |
| Juniper JUNOS | =20.3-r1-s1 | |
| Juniper JUNOS | =20.3-r2 | |
| Juniper JUNOS | =20.4-r1 | |
| Juniper JUNOS | =21.1 | |
| Juniper JUNOS | =21.1-r1-s1 |
Remedy
The following software releases have been updated to resolve this specific issue: Junos OS 18.4R1-S8, 18.4R2-S8, 18.4R3-S8, 19.1R2-S3, 19.1R3-S5, 19.2R1-S7, 19.2R3-S2, 19.3R2-S6, 19.3R3-S2, 19.4R1-S4, 19.4R2-S4, 19.4R3-S3, 20.1R2-S2, 20.1R3, 20.2R2-S3, 20.2R3, 20.3R2-S1, 20.3R3, 20.4R2, 21.1R1, and all subsequent releases. Junos OS Evolved 20.4R2-EVO, 21.1R2-EVO, 21.2R1-EVO, and all subsequent releases.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2021-31350?
The severity of CVE-2021-31350 is critical as it allows low-privileged authenticated attackers to perform operations as root.
How do I fix CVE-2021-31350?
To fix CVE-2021-31350, upgrade the Junos OS or the Junos OS Evolved to a version that includes the security patch for this vulnerability.
What systems are affected by CVE-2021-31350?
CVE-2021-31350 affects various versions of Juniper Networks' Junos OS and Junos OS Evolved, specifically 18.4, 19.1, 19.2, 19.3, 19.4, and 20.1.
Who is vulnerable to CVE-2021-31350?
Low-privileged authenticated attackers on networks that utilize the gRPC framework in affected versions of Juniper Networks products are vulnerable to CVE-2021-31350.
What kind of vulnerability is CVE-2021-31350?
CVE-2021-31350 is categorized as an Improper Privilege Management vulnerability.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/references
- agent/title
- agent/severity
- agent/remedy
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/juniper
- canonical/junos os evolved
- version/junos os evolved/18.4
- version/junos os evolved/18.4-r1
- version/junos os evolved/18.4-r1-s1
- version/junos os evolved/18.4-r1-s2
- version/junos os evolved/18.4-r1-s3
- version/junos os evolved/18.4-r1-s4
- version/junos os evolved/18.4-r1-s5
- version/junos os evolved/18.4-r1-s6
- version/junos os evolved/18.4-r1-s7
- version/junos os evolved/18.4-r2-s8
- version/junos os evolved/18.4-r3-s8
- version/junos os evolved/19.1
- version/junos os evolved/19.1-r1
- version/junos os evolved/19.1-r1-s1
- version/junos os evolved/19.1-r1-s2
- version/junos os evolved/19.1-r1-s3
- version/junos os evolved/19.1-r1-s4
- version/junos os evolved/19.1-r1-s5
- version/junos os evolved/19.1-r1-s6
- version/junos os evolved/19.1-r2
- version/junos os evolved/19.1-r2-s1
- version/junos os evolved/19.1-r2-s2
- version/junos os evolved/19.1-r3-s5
- version/junos os evolved/19.2
- version/junos os evolved/19.2-r1
- version/junos os evolved/19.2-r1-s1
- version/junos os evolved/19.2-r1-s2
- version/junos os evolved/19.2-r1-s3
- version/junos os evolved/19.2-r1-s4
- version/junos os evolved/19.2-r1-s5
- version/junos os evolved/19.2-r1-s6
- version/junos os evolved/19.2-r3-s2
- version/junos os evolved/19.3
- version/junos os evolved/19.3-r1
- version/junos os evolved/19.3-r1-s1
- version/junos os evolved/19.3-r2
- version/junos os evolved/19.3-r2-s1
- version/junos os evolved/19.3-r2-s2
- version/junos os evolved/19.3-r2-s3
- version/junos os evolved/19.3-r2-s4
- version/junos os evolved/19.3-r2-s5
- version/junos os evolved/19.3-r3-s2
- version/junos os evolved/19.4-r1
- version/junos os evolved/19.4-r1-s1
- version/junos os evolved/19.4-r1-s2
- version/junos os evolved/19.4-r1-s3
- version/junos os evolved/19.4-r2-s4
- version/junos os evolved/19.4-r3-s3
- version/junos os evolved/20.1-r1
- version/junos os evolved/20.1-r1-s1
- version/junos os evolved/20.1-r1-s2
- version/junos os evolved/20.1-r1-s3
- version/junos os evolved/20.1-r1-s4
- version/junos os evolved/20.1-r2
- version/junos os evolved/20.1-r2-s1
- version/junos os evolved/20.1-r3
- version/junos os evolved/20.2-r1
- version/junos os evolved/20.2-r1-s1
- version/junos os evolved/20.2-r1-s2
- version/junos os evolved/20.2-r1-s3
- version/junos os evolved/20.2-r2
- version/junos os evolved/20.2-r2-s1
- version/junos os evolved/20.2-r2-s2
- version/junos os evolved/20.2-r3
- version/junos os evolved/20.3-r1
- version/junos os evolved/20.3-r1-s1
- version/junos os evolved/20.3-r2
- version/junos os evolved/20.3-r3
- version/junos os evolved/20.4-r1
- version/junos os evolved/20.4-r1-s1
- canonical/juniper junos
- version/juniper junos/18.3-r1
- version/juniper junos/19.1-r1
- version/juniper junos/19.1-r2
- version/juniper junos/19.2-r1
- version/juniper junos/19.2-r2
- version/juniper junos/19.3-r1
- version/juniper junos/19.3-r2
- version/juniper junos/19.4-r1
- version/juniper junos/19.4-r1-s1
- version/juniper junos/20.1-r1
- version/juniper junos/20.1-r1-s1
- version/juniper junos/20.1-r2
- version/juniper junos/20.1-r2-s1
- version/juniper junos/20.1-r2-s2
- version/juniper junos/20.2-r1
- version/juniper junos/20.2-r1-s1
- version/juniper junos/20.2-r2
- version/juniper junos/20.3-r1
- version/juniper junos/20.3-r1-s1
- version/juniper junos/20.3-r2
- version/juniper junos/20.4-r1
- version/juniper junos/21.1
- version/juniper junos/21.1-r1-s1