CVE-2023-36845
Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
Description
CVE-2023-36845 is a critical PHP external variable modification vulnerability in the J-Web management interface of Juniper Networks Junos OS on EX Series and SRX Series devices that allows unauthenticated remote code execution. By sending a crafted request that sets the PHPRC variable, an attacker can modify the PHP execution environment to inject and execute arbitrary code on the affected Juniper device. CISA has confirmed active exploitation of CVE-2023-36845 in the wild and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 17, 2023. With a CVSS score of 9.8 (Critical) and an EPSS score of 94.4% in the 99.9th percentile, this Juniper Junos OS remote code execution vulnerability demands immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| juniper | junos | < 20.4; 20.4; 21.1; 21.2; 21.3; 21.4; 22.1; 22.2; 22.3; 22.4; 23.2 |
References
- http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://supportportal.juniper.net/JSA72300(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36845(US Government Resource)
Weakness Type
CWE-473: PHP External Variable Modification
In CVE-2023-36845, the J-Web interface of Junos OS on EX Series and SRX Series devices allows an unauthenticated attacker to set the PHPRC environment variable through crafted HTTP requests, enabling complete modification of the PHP execution environment. This PHP external variable modification weakness is directly leveraged to inject malicious PHP configuration that leads to arbitrary code execution on the underlying Juniper device.
Learn more: CWE-473 — PHP External Variable Modification
Impact Analysis
CVE-2023-36845 carries a CVSS 3.1 score of 9.8 (Critical), representing the highest risk tier for security vulnerabilities. The vulnerability is remotely exploitable without physical access, requires no authentication, demands no user interaction, and has low attack complexity, meaning any attacker with network access to the J-Web interface can achieve remote code execution with minimal effort. Confidentiality (High): successful exploitation grants the attacker access to all data on the Juniper device, including network configurations, routing tables, firewall rules, and credentials. Integrity (High): attackers can modify device configurations, alter firewall policies, redirect network traffic, and deploy persistent backdoors. Availability (High): full device compromise allows attackers to disrupt network operations, take devices offline, or manipulate traffic flow. The EPSS score of 94.4% indicates near-certain exploitation activity, and with both EX Series switches and SRX Series firewalls affected, exploitation of CVE-2023-36845 can compromise critical network infrastructure.
Exploit Maturity
Public exploit code is available for CVE-2023-36845 via Packet Storm Security and a second Packet Storm entry, providing remote code execution exploits targeting Juniper SRX Firewalls and EX Switches. CISA has confirmed active exploitation of CVE-2023-36845 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a remediation deadline of November 17, 2023. The EPSS score of 94.4% indicates near-certain exploitation activity, placing it in the 99.9th percentile of all scored vulnerabilities. This vulnerability is commonly exploited alongside related J-Web vulnerabilities such as CVE-2023-36844 and CVE-2023-36846, forming exploit chains that provide unauthenticated remote code execution on Juniper network devices.
Remediation
- Apply Juniper security patches immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Refer to the Juniper Security Advisory JSA72300 for specific patch details.
- Upgrade Junos OS on EX Series and SRX Series devices to the fixed versions: 20.4R3-S9 or later, 21.2R3-S7 or later, 21.3R3-S5 or later, 21.4R3-S5 or later, 22.1R3-S4 or later, 22.2R3-S2 or later, 22.3R2-S2 or 22.3R3-S1 or later, 22.4R2-S1 or 22.4R3 or later, or 23.2R1-S1 or 23.2R2 or later. Note that the 21.1 branch has no fix; upgrade to a supported release.
- Disable or restrict access to the J-Web management interface immediately as an interim mitigation. Block all external access to J-Web using firewall rules and restrict management access to dedicated out-of-band management networks only.
- Monitor device logs for indicators of compromise, particularly looking for HTTP requests attempting to set the PHPRC variable, unusual PHP process execution, unauthorized configuration changes, and any signs of web shell deployment on the Juniper devices.
- Implement strict network segmentation for management interfaces to ensure Juniper device management planes are isolated from production traffic and not accessible from untrusted networks. Consider implementing multi-factor authentication for all administrative access to network infrastructure.
Technical Details
CVE-2023-36845 exploits a PHP external variable modification weakness (CWE-473) in the J-Web management interface of Juniper Networks Junos OS running on both EX Series switches and SRX Series firewalls. The vulnerability specifically targets the PHPRC environment variable, which controls the path to the PHP configuration file (php.ini); by setting this variable through a crafted HTTP request to the J-Web interface, an attacker can point the PHP runtime to a malicious configuration file that enables arbitrary code injection and execution. As reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), the attack is network-based, requires no privileges, no user interaction, and has low complexity, achieving the maximum impact across confidentiality, integrity, and availability. Unlike the related CVE-2023-36844 which has limited direct impact, CVE-2023-36845 directly enables remote code execution by manipulating the PHP execution environment to inject and run attacker-controlled code on the underlying Junos OS.
Frequently Asked Questions
Is CVE-2023-36845 being actively exploited?
Yes, CVE-2023-36845 is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 17, 2023. Multiple public exploits are available, and the EPSS score of 94.4% in the 99.9th percentile confirms widespread active exploitation.
What products are affected by CVE-2023-36845?
CVE-2023-36845 affects Juniper Networks Junos OS on both EX Series switches and SRX Series firewalls. Affected versions include all releases prior to 20.4R3-S9, all 21.1 versions from 21.1R1 onward, and various versions in the 21.2 through 23.2 branches prior to their respective fixes as detailed in Juniper advisory JSA72300.
How do I fix CVE-2023-36845?
Upgrade Junos OS on affected EX Series and SRX Series devices to the fixed version for your release branch as specified in Juniper advisory JSA72300. As an immediate interim measure, disable or restrict all external access to the J-Web management interface and limit management access to trusted networks only.
How severe is CVE-2023-36845?
CVE-2023-36845 has a CVSS 3.1 score of 9.8 (Critical) and an EPSS score in the 99.9th percentile, making it one of the most critical actively exploited vulnerabilities affecting Juniper network infrastructure. The combination of unauthenticated remote code execution, low attack complexity, and public exploit availability makes this an immediate-action priority for any organization running affected Juniper devices.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.