CVE-2023-36847
Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
Description
CVE-2023-36847 is a missing authentication vulnerability in Juniper Networks Junos OS on EX Series switches that allows an unauthenticated, network-based attacker to upload arbitrary files through the J-Web management interface. The flaw exists in the installAppPackage.php endpoint, which fails to enforce authentication checks, enabling attackers to compromise file system integrity and potentially chain this vulnerability with other exploits. With a CVSS score of 5.3 (Medium) and an EPSS score of 94.0%, CVE-2023-36847 is under widespread active exploitation and has been added to CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 17, 2023. Organizations running affected versions of Junos OS on EX Series devices should prioritize patching immediately to prevent unauthorized file uploads and further compromise.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| juniper | junos | < 20.4; 20.4; 21.1; 21.2; 21.3; 21.4; 22.1; 22.2; 22.3; 22.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://supportportal.juniper.net/JSA72300(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36847(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
The missing authentication for critical function weakness in CVE-2023-36847 manifests through the J-Web interface's installAppPackage.php endpoint, which processes file upload requests without verifying the identity of the requester. In Juniper Junos OS on EX Series, this means any network-accessible attacker can submit crafted requests to upload arbitrary files to the device's file system, bypassing the authentication mechanisms that should protect administrative operations.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2023-36847 carries a CVSS v3.1 score of 5.3 (Medium severity) and is remotely exploitable without physical access via the network attack vector. The vulnerability requires no authentication and no user interaction to exploit, making it trivially accessible to any attacker who can reach the J-Web management interface. Attack Complexity (Low): No special conditions or preparation are needed to exploit this flaw. While the scope remains unchanged and there is no direct impact to confidentiality or availability, the Integrity Impact (Low) allows attackers to modify portions of the file system by uploading arbitrary files. The EPSS score of 94.0% (99.9th percentile) indicates near-certain exploitation activity, and CISA has confirmed active exploitation in the wild by adding CVE-2023-36847 to the KEV catalog. Although the individual impact of this vulnerability appears moderate, the ability to upload files to the device creates significant risk for chaining with other vulnerabilities to achieve full system compromise.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-36847 in the wild, adding it to the Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of November 17, 2023. The EPSS score of 94.0% (99.9th percentile) indicates near-certain exploitation activity across internet-facing Juniper EX Series devices. While no specific public exploit code is tagged in the available references, the widespread active exploitation and the simplicity of the attack (unauthenticated HTTP request to installAppPackage.php) make this vulnerability highly actionable. This vulnerability is commonly associated with other Juniper J-Web flaws such as CVE-2023-36844, CVE-2023-36845, and CVE-2023-36846, which when chained together enable unauthenticated remote code execution on affected devices.
Remediation
- Apply vendor patches immediately as directed by CISA's KEV required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Refer to Juniper's advisory JSA72300 for specific guidance.
- Upgrade Junos OS on EX Series to a fixed release: 20.4R3-S8 or later, 21.2R3-S6 or later, 21.3R3-S5 or later, 21.4R3-S4 or later, 22.1R3-S3 or later, 22.2R3-S1 or later, 22.3R2-S2 / 22.3R3 or later, or 22.4R2-S1 / 22.4R3 or later. Note that the 21.1 branch has no fix and should be upgraded to a supported release.
- Disable or restrict access to the J-Web interface as an interim mitigation. If J-Web must remain enabled, restrict access to trusted management networks only using firewall rules or access control lists to prevent unauthenticated access from untrusted networks.
- Monitor logs for suspicious activity targeting the installAppPackage.php endpoint, including unexpected file upload requests, new or modified files in application directories, and any indicators of chained exploitation attempts.
- Implement network segmentation to isolate management interfaces from general network traffic, ensuring that administrative interfaces like J-Web are only accessible from dedicated management VLANs or jump hosts.
Technical Details
CVE-2023-36847 exploits a missing authentication for critical function (CWE-306) in the J-Web management interface of Juniper Junos OS running on EX Series switches. The vulnerability specifically targets the installAppPackage.php endpoint, which is designed to handle application package installations but fails to validate whether the requesting user has been properly authenticated. An attacker can send a crafted HTTP request to this endpoint to upload arbitrary files to the device's file system without providing any credentials. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms that exploitation is network-based, requires low complexity, no privileges, and no user interaction, though the direct impact is limited to low integrity compromise. The critical risk lies in the chaining potential: uploaded files can be leveraged alongside other J-Web vulnerabilities (such as CVE-2023-36844 and CVE-2023-36845 for PHP environment variable injection, or CVE-2023-36846 for additional unauthenticated file uploads) to achieve full remote code execution on the affected device.
Frequently Asked Questions
Is CVE-2023-36847 being actively exploited?
Yes, CVE-2023-36847 is under active exploitation. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog with a remediation deadline of November 17, 2023. The EPSS score of 94.0% further confirms widespread exploitation activity targeting Juniper EX Series devices.
What products are affected by CVE-2023-36847?
CVE-2023-36847 affects Juniper Networks Junos OS running on EX Series switches. Affected versions include all versions prior to 20.4R3-S8, all 21.1 versions from 21.1R1 onward, 21.2 versions prior to 21.2R3-S6, 21.3 versions prior to 21.3R3-S5, 21.4 versions prior to 21.4R3-S4, 22.1 versions prior to 22.1R3-S3, 22.2 versions prior to 22.2R3-S1, 22.3 versions prior to 22.3R2-S2 or 22.3R3, and 22.4 versions prior to 22.4R2-S1 or 22.4R3.
How do I fix CVE-2023-36847?
Upgrade Junos OS on your EX Series devices to a patched release as specified in Juniper advisory JSA72300. As an immediate interim measure, disable the J-Web interface or restrict its access to trusted management networks only. Refer to the Remediation section for version-specific upgrade guidance.
How severe is CVE-2023-36847?
CVE-2023-36847 has a CVSS v3.1 score of 5.3 (Medium severity). While the individual vulnerability impact is limited to file system integrity, the EPSS score of 94.0% (99.9th percentile) indicates extremely high exploitation likelihood. The severity is significantly amplified when this vulnerability is chained with related J-Web flaws to achieve remote code execution.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.