CVE-2023-28960 : What You Need to Know

This CVE-2023-28960 pertains to an Incorrect Permission Assignment for Critical Resource vulnerability in Juniper Networks Junos OS Evolved, which allows a local, authenticated low-privileged attacker to inject potentially malicious files into an existing Docker container on the local system.

Understanding CVE-2023-28960

This vulnerability can be exploited by a low-privileged local user to inject files into Docker containers, potentially leading to the execution of malicious files as root.

What is CVE-2023-28960?

The vulnerability in Juniper Networks Junos OS Evolved allows a low-privileged attacker to manipulate Docker containers by injecting malicious files. This issue only affects systems with Docker configured and enabled, which is not the default setting.

The Impact of CVE-2023-28960

If successfully exploited, this vulnerability could result in unauthorized access and execution of malicious code as a privileged user, potentially leading to a compromise of the affected system.

Technical Details of CVE-2023-28960

This section provides more insight into the vulnerability, affected systems, and the exploitation mechanism.

Vulnerability Description

The vulnerability allows a low-privileged local user to copy potentially malicious files into an existing Docker container on the local system, opening the door to execution as root.

Affected Systems and Versions

The issue affects Juniper Networks Junos OS Evolved versions:

20.4 versions prior to 20.4R3-S5-EVO
21.2 versions prior to 21.2R3-EVO
21.3 versions prior to 21.3R3-EVO
21.4 versions prior to 21.4R2-EVO

Exploitation Mechanism

The vulnerability can be exploited by a local, authenticated low-privileged attacker through Docker containers with the potential to execute malicious files as a privileged user.

Mitigation and Prevention

Here are some measures to mitigate and prevent exploitation of CVE-2023-28960.

Immediate Steps to Take

Ensure Docker is not enabled by default if not required.
Apply the necessary security patches provided by Juniper Networks.
Monitor and restrict low-privileged user access to critical system resources.

Long-Term Security Practices

Regularly update and patch software to prevent known vulnerabilities.
Implement stringent access controls and permissions within the system.

Patching and Updates

Juniper Networks has released updated software versions to address this vulnerability. Ensure that your system is running one of the following patched versions:

Junos OS Evolved 20.4R3-S5-EVO
21.2R3-EVO
21.3R3-EVO
21.4R2-EVO
22.1R1-EVO, and any subsequent releases.

Remember, proactive security measures are key to safeguarding your systems against potential threats.