CVE-2023-36851
Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
Description
CVE-2023-36851 is a missing authentication vulnerability in Juniper Networks Junos OS on SRX Series firewalls that enables an unauthenticated, network-based attacker to upload and download arbitrary files through the J-Web management interface. The flaw resides in the webauth_operation.php endpoint, which does not enforce authentication, allowing attackers to compromise both the integrity and confidentiality of the file system. CISA has added CVE-2023-36851 to its Known Exploited Vulnerabilities catalog with a remediation deadline of November 17, 2023, and the vulnerability's EPSS score of 14.9% indicates a significant probability of exploitation. Organizations using Juniper SRX Series devices with J-Web enabled should apply patches immediately or restrict access to the management interface.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| juniper | junos | 21.2; 21.4; 22.1; 22.2; 22.3; 22.4; 23.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://supportportal.juniper.net/JSA72300(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36851(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
In the context of CVE-2023-36851, the missing authentication weakness manifests through the J-Web interface's webauth_operation.php endpoint on Juniper Junos OS SRX Series devices. This endpoint handles file operations but does not verify whether the requesting party is authenticated, allowing any network-accessible attacker to upload and download files without credentials. This lack of authentication on a critical administrative function directly enables unauthorized access to the device's file system.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2023-36851 carries a CVSS v3.1 score of 5.3 (Medium severity) and is remotely exploitable over the network without any special conditions. Privileges Required (None): The vulnerability requires no authentication whatsoever, meaning any attacker with network access to the J-Web interface can exploit it. User Interaction (None): No action from a legitimate user is required for successful exploitation. Attack Complexity (Low): The exploit is straightforward with no race conditions or special configurations needed. While the scope remains unchanged and the direct impact is limited to Integrity (Low), the description notes that attackers can both upload and download arbitrary files, effectively impacting confidentiality as well. The EPSS score of 14.9% (94.4th percentile) indicates a meaningful probability of exploitation, and CISA has confirmed active exploitation in the wild. The ability to download files from SRX Series firewalls, which serve as critical network security infrastructure, creates risk of exposing sensitive configuration data, credentials, and network topology information that could facilitate further attacks.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-36851 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of November 17, 2023. The EPSS score of 14.9% (94.4th percentile) reflects a substantial exploitation probability. While no specific public exploit code is tagged in the available references, the vulnerability's straightforward exploitation mechanism (unauthenticated HTTP requests to webauth_operation.php) makes it accessible to a wide range of threat actors. This vulnerability is part of a broader set of Juniper J-Web vulnerabilities disclosed alongside CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847, which when chained together can enable unauthenticated remote code execution on Juniper devices.
Remediation
- Apply vendor patches immediately as required by CISA's KEV catalog: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Consult Juniper's advisory JSA72300 for detailed guidance.
- Upgrade Junos OS on SRX Series to a fixed release: 21.2R3-S8 or later, 21.4R3-S6 or later, 22.1R3-S5 or later, 22.2R3-S3 or later, 22.3R3-S2 or later, 22.4R2-S2 / 22.4R3 or later, or 23.2R1-S2 / 23.2R2 or later.
- Disable or restrict access to the J-Web interface as an immediate interim mitigation. Apply firewall rules or access control lists to ensure J-Web is only accessible from trusted management networks, preventing unauthenticated access from untrusted sources.
- Audit file system integrity on SRX Series devices for signs of unauthorized file uploads or downloads, review J-Web access logs for requests to webauth_operation.php, and check for any indicators of compromise or lateral movement.
- Implement management plane segmentation by placing device management interfaces on isolated management VLANs with strict access controls, and enforce multi-factor authentication for all administrative access to network infrastructure.
Technical Details
CVE-2023-36851 is a missing authentication for critical function (CWE-306) vulnerability in the J-Web management interface of Juniper Junos OS on SRX Series firewalls. The flaw exists in the webauth_operation.php endpoint, which is designed to handle web authentication operations but fails to verify that incoming requests originate from authenticated users. An attacker can craft specific HTTP requests to this endpoint to upload arbitrary files to and download files from the SRX device's file system without providing any credentials. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) reflects that exploitation occurs over the network with low complexity and requires no privileges or user interaction, though the formally rated integrity impact is low. The bidirectional file access (upload and download) is particularly concerning on SRX Series devices, which function as firewalls and security gateways, as attackers could exfiltrate sensitive configuration files, VPN credentials, or security policies, and upload malicious files that could be leveraged in combination with other J-Web vulnerabilities for full remote code execution.
Frequently Asked Questions
Is CVE-2023-36851 being actively exploited?
Yes, CVE-2023-36851 is under active exploitation. CISA has included this vulnerability in its Known Exploited Vulnerabilities catalog with a remediation deadline of November 17, 2023. The EPSS score of 14.9% indicates a significant likelihood of exploitation targeting internet-exposed Juniper SRX Series devices.
What products are affected by CVE-2023-36851?
CVE-2023-36851 affects Juniper Networks Junos OS on SRX Series firewalls. Affected versions include 21.2 prior to 21.2R3-S8, 21.4 prior to 21.4R3-S6, 22.1 prior to 22.1R3-S5, 22.2 prior to 22.2R3-S3, 22.3 prior to 22.3R3-S2, 22.4 prior to 22.4R2-S2 or 22.4R3, and 23.2 prior to 23.2R1-S2 or 23.2R2.
How do I fix CVE-2023-36851?
Upgrade Junos OS on your SRX Series devices to a patched release as detailed in Juniper advisory JSA72300. As an immediate interim measure, disable the J-Web interface or restrict access to it using firewall rules that limit connectivity to trusted management networks only. See the Remediation section for version-specific guidance.
How severe is CVE-2023-36851?
CVE-2023-36851 has a CVSS v3.1 score of 5.3 (Medium severity). Although the individual vulnerability's rated impact is limited, it enables both file upload and download on SRX Series firewalls, which are critical security infrastructure. The EPSS score of 14.9% (94.4th percentile) indicates meaningful exploitation risk, especially when this vulnerability is chained with related J-Web flaws.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.