CVE-2023-36844
Juniper Junos OS EX Series PHP External Variable Modification Vulnerability
Description
CVE-2023-36844 is a PHP external variable modification vulnerability in the J-Web management interface of Juniper Networks Junos OS on EX Series switches. This flaw allows an unauthenticated, network-based attacker to manipulate critical PHP environment variables through crafted requests, leading to partial loss of integrity. While the individual CVSS score of CVE-2023-36844 is rated Medium at 5.3, the vulnerability is particularly dangerous because it can be chained with other Junos OS vulnerabilities to achieve remote code execution. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, and the EPSS score of 94.3% indicates near-certain exploitation activity, reflecting the severity of this Juniper Junos OS security flaw in real-world attack scenarios.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| juniper | junos | < 20.4; 20.4; 21.1; 21.2; 21.3; 21.4; 22.1; 22.2; 22.3; 22.4; 23.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://supportportal.juniper.net/JSA72300(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36844(US Government Resource)
Weakness Type
CWE-473: PHP External Variable Modification
In the context of CVE-2023-36844, the J-Web interface of Junos OS on EX Series switches does not properly restrict the modification of PHP environment variables through external input. An attacker can send crafted requests that alter critical PHP configuration variables, which can be leveraged to modify the PHP execution environment and enable further exploitation when chained with related vulnerabilities.
Learn more: CWE-473 — PHP External Variable Modification
Impact Analysis
CVE-2023-36844 carries a CVSS 3.1 score of 5.3 (Medium), but its real-world impact is amplified significantly by its use in exploit chains. The vulnerability is remotely exploitable without physical access, requires no authentication, demands no user interaction, and has low attack complexity, meaning any network-connected attacker can target exposed J-Web interfaces on Juniper EX Series switches. Integrity (Low): the direct impact allows partial modification of PHP environment variables, which alone represents limited integrity loss. However, Confidentiality and Availability are not directly impacted by this vulnerability in isolation. The EPSS score of 94.3% places this vulnerability in the 99.9th percentile for exploitation probability, reflecting that attackers are actively chaining CVE-2023-36844 with companion vulnerabilities to achieve full remote code execution on Juniper network infrastructure.
Exploit Maturity
Public exploit code is available for CVE-2023-36844 via Packet Storm Security, which provides a combined remote code execution exploit targeting Juniper SRX Firewalls and EX Switches. CISA has confirmed active exploitation of CVE-2023-36844 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a remediation deadline of November 17, 2023. The EPSS score of 94.3% indicates near-certain exploitation activity, placing it in the 99.9th percentile of all scored vulnerabilities. This vulnerability is commonly chained with related J-Web flaws to escalate from PHP variable modification to full remote code execution on Juniper devices.
Remediation
- Apply Juniper security patches immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Refer to the Juniper Security Advisory JSA72300 for specific patch versions.
- Upgrade Junos OS on EX Series to the fixed versions: 20.4R3-S9 or later, 21.2R3-S7 or later, 21.3R3-S5 or later, 21.4R3-S5 or later, 22.1R3-S4 or later, 22.2R3-S2 or later, 22.3R3-S1 or later, 22.4R2-S2 or 22.4R3 or later, or 23.2R1-S1 or 23.2R2 or later. Note that the 21.1 branch has no fix; upgrade to a supported release.
- Disable or restrict access to the J-Web management interface immediately as an interim mitigation. Limit J-Web access to trusted management networks only using firewall rules or access control lists, and consider disabling J-Web entirely if it is not required for daily operations.
- Monitor Juniper device logs for suspicious HTTP requests targeting J-Web endpoints, particularly requests attempting to modify PHP variables such as PHPRC. Review access logs for unusual patterns from external IP addresses.
- Implement network segmentation to isolate Juniper management interfaces from general network traffic, ensuring that J-Web is only accessible from dedicated management VLANs and not exposed to the internet or untrusted network segments.
Technical Details
CVE-2023-36844 exploits a PHP external variable modification weakness (CWE-473) in the J-Web management interface of Juniper Networks Junos OS running on EX Series switches. The vulnerability allows an unauthenticated attacker to send specially crafted HTTP requests to the J-Web interface that modify critical PHP environment variables, altering the PHP execution environment on the device. As reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the attack is network-based with low complexity and requires no privileges or user interaction, though the direct impact is limited to low integrity loss with no confidentiality or availability impact. The significance of this vulnerability is greatly amplified when chained with related J-Web vulnerabilities, as the ability to control PHP environment variables can be leveraged to inject and execute arbitrary code, transforming a medium-severity variable modification flaw into a critical remote code execution attack chain on Juniper network infrastructure.
Frequently Asked Questions
Is CVE-2023-36844 being actively exploited?
Yes, CVE-2023-36844 is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 17, 2023. The EPSS score of 94.3% places it in the 99.9th percentile for exploitation probability, confirming widespread active exploitation.
What products are affected by CVE-2023-36844?
CVE-2023-36844 affects Juniper Networks Junos OS on EX Series switches across numerous versions. Affected versions include all releases prior to 20.4R3-S9, all 21.1 versions from 21.1R1 onward, and various versions in the 21.2 through 23.2 branches prior to their respective fixes. Consult Juniper advisory JSA72300 for the complete version matrix.
How do I fix CVE-2023-36844?
Upgrade Junos OS on affected EX Series switches to the fixed version for your release branch as specified in Juniper advisory JSA72300. As an immediate interim measure, disable or restrict network access to the J-Web management interface to trusted management networks only.
How severe is CVE-2023-36844?
CVE-2023-36844 has a CVSS 3.1 score of 5.3 (Medium) when considered in isolation, but its real-world severity is significantly higher due to its role in exploit chains that achieve remote code execution. The EPSS score in the 99.9th percentile and confirmed active exploitation demonstrate that this vulnerability poses a critical threat to organizations running affected Juniper EX Series switches.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.