Paragon Active Assurance: probe_serviced exposes internal objects to local users

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Juniper Networks Paragon Active Assurance Control Center allows a network-adjacent attacker with root access to a Test Agent Appliance the ability to access sensitive information about downstream devices. The "netrounds-probe-login" daemon (also called probe_serviced) exposes functions where the Test Agent (TA) Appliance pushes interface state/config, unregister itself, etc. The remote service accidentally exposes an internal database object that can be used for direct database access on the Paragon Active Assurance Control Center. This issue affects Paragon Active Assurance: 4.1.0, 4.2.0.

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

信息暴露

Juniper Networks Paragon Active Assurance 安全漏洞

Juniper Networks Paragon Active Assurance是美国瞻博网络（Juniper Networks）公司的一种可编程的测试和服务保证解决方案。使用基于软件和流量生成的测试代理，可作为 SaaS 解决方案从云中轻松使用和交付，或在 NFV 环境中本地部署。 Juniper Networks Paragon Active Assurance 4.1.0版本和4.2.0版本存在安全漏洞，该漏洞源于存在敏感信息泄露漏洞，攻击者能够访问有关下游设备的敏感信息。

N/A

N/A