External risk intelligence

Juniper Junos OS: Remote Code Execution Via J-Web

CVE advisoryKnown Exploit

CVE-2023-36845

The vulnerability affects J-Web, the web-based management interface for Juniper networking devices. Management interfaces for edge network equipment like firewalls and switches are designed to be accessible to administrators, and such interfaces are frequently exposed to the internet, making this a highly reachable attack surface.

Juniper Junos

before 20.420.421.121.221.3

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The J-Web component within Juniper Networks Junos OS on EX and SRX Series devices has a vulnerability related to the modification of PHP external variables. This flaw allows an attacker to manipulate the PHP execution environment by sending a specially crafted request. This manipulation can lead to the injection and execution of unauthorized code on the affected systems.

Vulnerable: Juniper J-Web
Flaw: Modifies PHP execution environment
Impact: Remote code execution

Attack Path

How an attacker could exploit the issue

A network-based attacker can exploit a vulnerability in Juniper Networks Junos OS, specifically within the J-Web interface of EX and SRX Series devices. This allows an unauthenticated attacker to send a crafted request that manipulates the PHP environment. By modifying the `PHPRC` variable, the attacker can inject and execute arbitrary code on the affected system. This can lead to unauthorized access and control over the compromised device.

Exposure via J-Web interface
Attacker sends crafted request
Code injection and execution

Live Threat

Current exploitation, exposure, and threat context

A critical vulnerability exists in Juniper Networks Junos OS affecting EX and SRX series devices. This flaw allows unauthenticated, remote attackers to execute code by manipulating PHP environment variables through crafted requests. The potential impact includes unauthorized code execution, leading to compromised systems and sensitive data exposure.

Attackers with network access.
No special conditions required.
Significant business risk; urgent attention needed.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in Juniper Networks Junos OS could allow an unauthenticated attacker to execute code remotely. The attack exploits a modification of PHP variables, enabling code injection and execution through crafted requests. Organizations using affected Juniper EX Series and SRX Series devices should prioritize addressing this risk.

Identify all affected Juniper EX and SRX devices.
Restrict network access to J-Web.
Apply vendor updates and verify.
Monitor for suspicious activity.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Junos OS and which Juniper devices use it?

Juniper Networks Junos OS is the operating system for Juniper's EX Series Ethernet Switches and SRX Series Next-Generation Firewalls. These devices are fundamental to network infrastructure, managing traffic, security, and connectivity for businesses and data centers.

How does CVE-2023-36845 enable remote code execution in Junos OS?

CVE-2023-36845 is an External Variable Modification vulnerability. It allows an attacker to alter the PHP execution environment by sending a crafted request that modifies the PHPRC variable, enabling code injection and execution.

What is the attack vector for CVE-2023-36845 on Juniper EX and SRX devices?

An unauthenticated, network-based attacker can exploit this vulnerability by sending a crafted request to the J-Web interface. This request manipulates the PHP execution environment, allowing for code injection and execution without prior authentication.

What is the relevance of the J-Web interface in this vulnerability?

The J-Web interface, a web-based management tool for Juniper devices, is the entry point for this attack. Its accessibility, often to administrators, makes it a critical component in the exploitation path. The attack surface is considered external and highly reachable due to its function.

What practical steps should be taken to address CVE-2023-36845?

Organizations should identify all affected Juniper EX and SRX devices, restrict network access to the J-Web interface, and apply vendor-provided updates. Monitoring for suspicious activity post-remediation is also advised to ensure security.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.