CVE-2024-21589
📋 TL;DR
An unauthenticated attacker can access sensitive reports in Juniper Networks Paragon Active Assurance Control Center without logging in, potentially exposing configuration data. This affects on-premises versions 3.1.0 through 3.4.0, but not SaaS deployments or versions before 3.1.0.
💻 Affected Systems
- Juniper Networks Paragon Active Assurance Control Center
📦 What is this software?
Paragon Active Assurance Control Center by Juniper
View all CVEs affecting Paragon Active Assurance Control Center →
Paragon Active Assurance Control Center by Juniper
View all CVEs affecting Paragon Active Assurance Control Center →
Paragon Active Assurance Control Center by Juniper
View all CVEs affecting Paragon Active Assurance Control Center →
Paragon Active Assurance Control Center by Juniper
View all CVEs affecting Paragon Active Assurance Control Center →
⚠️ Risk & Real-World Impact
Worst Case
Complete exfiltration of sensitive network configuration data, credentials, and operational reports leading to network compromise.
Likely Case
Unauthorized access to configuration reports containing network topology, device information, and potentially credentials.
If Mitigated
Limited exposure if proper network segmentation and access controls prevent external access to the Control Center.
🎯 Exploit Status
Exploitation requires network access to the Control Center but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor advisory for specific fixed versions
Vendor Advisory: https://supportportal.juniper.net/JSA75727
Restart Required: Yes
Instructions:
1. Review JSA75727 advisory. 2. Apply vendor-recommended patches. 3. Restart affected services. 4. Verify fix implementation.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict network access to Paragon Active Assurance Control Center to trusted IPs only
iptables -A INPUT -p tcp --dport <control_center_port> -s <trusted_ip> -j ACCEPT
iptables -A INPUT -p tcp --dport <control_center_port> -j DROP
🧯 If You Can't Patch
- Isolate the Control Center behind a firewall with strict IP-based access controls
- Implement network segmentation to prevent unauthorized access to the Control Center subnet
🔍 How to Verify
Check if Vulnerable:
Check if Paragon Active Assurance Control Center version is 3.1.0, 3.2.0, 3.2.2, 3.3.0, 3.3.1, or 3.4.0Check Version:
Check web interface or system documentation for version informationVerify Fix Applied:
Verify version is updated to vendor-recommended patched version and test unauthenticated report access is blocked📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access to report endpoints
- Failed authentication attempts followed by successful report access
Network Indicators:
- Unusual report download patterns from unauthenticated IPs
- External IPs accessing report endpoints without authentication
SIEM Query:
source="paragon_logs" AND (url="*/reports/*" OR url="*/api/reports*") AND auth_status="unauthenticated"