CVE-2024-30381
📋 TL;DR
This vulnerability allows a network-adjacent attacker with root access to a Test Agent Appliance to access sensitive information about downstream devices in Juniper Networks Paragon Active Assurance Control Center. The 'netrounds-probe-login' daemon accidentally exposes an internal database object, enabling direct database access. This affects Paragon Active Assurance versions 4.1.0 and 4.2.0.
💻 Affected Systems
- Juniper Networks Paragon Active Assurance Control Center
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Paragon Active Assurance Control Center database, exposing all sensitive configuration data, credentials, and downstream device information to unauthorized actors.
Likely Case
Unauthorized access to sensitive network configuration data, interface states, and device information from downstream systems managed by the Control Center.
If Mitigated
Limited exposure if network segmentation prevents adjacent attackers from reaching Test Agent Appliances and root access is properly controlled.
🎯 Exploit Status
Exploitation requires root access to a Test Agent Appliance and network adjacency. The vulnerability exposes database access functionality that could be leveraged by knowledgeable attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Juniper advisory for specific fixed versions
Vendor Advisory: https://supportportal.juniper.net/JSA79173
Restart Required: Yes
Instructions:
1. Review Juniper advisory JSA79173. 2. Apply the recommended patch/update from Juniper. 3. Restart affected services or appliances as directed by Juniper. 4. Verify the fix is applied.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Test Agent Appliances from untrusted networks and limit access to authorized administrative systems only.
Root Access Control
allImplement strict controls on root access to Test Agent Appliances and monitor for unauthorized privilege escalation.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Test Agent Appliances from potential attackers
- Enhance monitoring and logging of Test Agent Appliance access and database queries
🔍 How to Verify
Check if Vulnerable:
Check Paragon Active Assurance Control Center version. If running 4.1.0 or 4.2.0, the system is vulnerable.Check Version:
Check appliance web interface or CLI for version information (specific command depends on deployment)Verify Fix Applied:
Verify the system has been updated to a version not listed in the affected versions (4.1.0, 4.2.0) and check Juniper advisory for confirmation.📡 Detection & Monitoring
Log Indicators:
- Unusual database access patterns from Test Agent Appliances
- Unauthorized access attempts to probe_serviced daemon
Network Indicators:
- Unexpected database queries originating from Test Agent Appliance network segments
SIEM Query:
Search for: 'probe_serviced' OR 'netrounds-probe-login' with database access patterns from Test Agent IP addresses