CVE-2023-36846
Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
Description
CVE-2023-36846 is a missing authentication for critical function vulnerability in the J-Web management interface of Juniper Networks Junos OS on SRX Series firewalls. This flaw allows an unauthenticated, network-based attacker to upload arbitrary files to the device via J-Web by targeting the user.php endpoint, which lacks proper authentication checks. While the direct impact of CVE-2023-36846 is limited to partial integrity loss, it can be chained with other Junos OS vulnerabilities to achieve remote code execution. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 17, 2023, and its EPSS score of 94.2% in the 99.9th percentile confirms widespread exploitation of this Juniper Junos OS security flaw.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| juniper | junos | < 20.4; 20.4; 21.1; 21.2; 21.3; 21.4; 22.1; 22.2; 22.3; 22.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://supportportal.juniper.net/JSA72300(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36846(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
In CVE-2023-36846, the J-Web management interface of Junos OS on SRX Series firewalls exposes the user.php endpoint without requiring authentication, allowing any network-connected attacker to upload arbitrary files to the device. This missing authentication for a critical file upload function enables attackers to place malicious content on the Juniper SRX firewall, which can be chained with other vulnerabilities to achieve code execution.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2023-36846 carries a CVSS 3.1 score of 5.3 (Medium), though its real-world impact is substantially magnified when used in exploit chains targeting Juniper SRX Series firewalls. The vulnerability is remotely exploitable without physical access, requires no authentication, demands no user interaction, and has low attack complexity, meaning any attacker with network access to the J-Web interface can upload arbitrary files to the device. Integrity (Low): the direct impact is limited to unauthorized file uploads that affect a portion of the file system. Confidentiality and Availability are not directly impacted by this vulnerability in isolation. However, the EPSS score of 94.2% places this vulnerability in the 99.9th percentile for exploitation probability, reflecting that attackers are actively leveraging CVE-2023-36846 in combination with related J-Web vulnerabilities such as CVE-2023-36845 to escalate from unauthenticated file upload to full remote code execution on Juniper SRX firewalls.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-36846 in the wild by adding it to the Known Exploited Vulnerabilities catalog, with a remediation deadline of November 17, 2023. The EPSS score of 94.2% indicates near-certain exploitation activity, placing it in the 99.9th percentile of all scored vulnerabilities. While no standalone exploit code is tagged in the available references, CVE-2023-36846 is widely used as part of exploit chains with related J-Web vulnerabilities (such as CVE-2023-36845) where the unauthenticated file upload capability is combined with PHP environment modification to achieve remote code execution on Juniper SRX devices. The ransomware association is currently listed as unknown.
Remediation
- Apply Juniper security patches immediately as directed by CISA: "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable." Refer to the Juniper Security Advisory JSA72300 for specific patch details.
- Upgrade Junos OS on SRX Series devices to the fixed versions: 20.4R3-S8 or later, 21.2R3-S6 or later, 21.3R3-S5 or later, 21.4R3-S5 or later, 22.1R3-S3 or later, 22.2R3-S2 or later, 22.3R2-S2 or 22.3R3 or later, or 22.4R2-S1 or 22.4R3 or later. Note that the 21.1 branch has no fix; upgrade to a supported release.
- Disable or restrict access to the J-Web management interface immediately as an interim mitigation. Block all external access to J-Web using firewall rules and ensure that the user.php endpoint is not accessible from untrusted networks. Consider disabling J-Web entirely if it is not essential for operations.
- Audit the file system of affected SRX devices for unauthorized files that may have been uploaded through the unauthenticated user.php endpoint. Check for unexpected web shells, scripts, or configuration files that could indicate compromise.
- Implement network segmentation for management interfaces to isolate Juniper SRX management planes from production traffic. Ensure management access is restricted to dedicated management VLANs with strict access control lists, and monitor for unauthorized file upload attempts in J-Web access logs.
Technical Details
CVE-2023-36846 exploits a missing authentication for critical function weakness (CWE-306) in the J-Web management interface of Juniper Networks Junos OS running on SRX Series firewalls. The vulnerability exists in the user.php endpoint, which handles file upload operations but fails to enforce authentication, allowing any unauthenticated network-based attacker to upload arbitrary files to the device file system. As reflected in the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N), the attack is network-based with low complexity and requires no privileges or user interaction, though the direct impact is limited to low integrity loss with no confidentiality or availability impact. The true danger of CVE-2023-36846 emerges when it is chained with companion vulnerabilities such as CVE-2023-36845, where the ability to upload arbitrary files provides the initial foothold needed to deploy malicious PHP configuration files that are then leveraged through PHP environment variable manipulation to achieve full remote code execution on the Juniper SRX firewall.
Frequently Asked Questions
Is CVE-2023-36846 being actively exploited?
Yes, CVE-2023-36846 is being actively exploited in the wild. CISA has added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of November 17, 2023. The EPSS score of 94.2% places it in the 99.9th percentile for exploitation probability, confirming widespread active exploitation typically as part of exploit chains with related Juniper vulnerabilities.
What products are affected by CVE-2023-36846?
CVE-2023-36846 affects Juniper Networks Junos OS on SRX Series firewalls. Affected versions include all releases prior to 20.4R3-S8, all 21.1 versions from 21.1R1 onward, and various versions in the 21.2 through 22.4 branches prior to their respective fixes as detailed in Juniper advisory JSA72300.
How do I fix CVE-2023-36846?
Upgrade Junos OS on affected SRX Series devices to the fixed version for your release branch as specified in Juniper advisory JSA72300. As an immediate interim measure, disable or restrict all external access to the J-Web management interface and audit the device file system for any unauthorized files that may have been uploaded.
How severe is CVE-2023-36846?
CVE-2023-36846 has a CVSS 3.1 score of 5.3 (Medium) when considered in isolation, but its real-world severity is significantly higher due to its role in exploit chains that achieve remote code execution on Juniper SRX firewalls. The EPSS score in the 99.9th percentile and confirmed active exploitation demonstrate that this vulnerability is a critical threat requiring immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.