CVE-2023-36844: Juniper Junos PHP Variable Vulnerability

CVE-2023-36844 Overview

A PHP External Variable Modification vulnerability exists in the J-Web component of Juniper Networks Junos OS on EX Series switches. This vulnerability allows an unauthenticated, network-based attacker to control certain important environment variables through crafted HTTP requests. By manipulating PHP environment variables, an attacker can achieve partial loss of integrity on the affected system, which may enable chaining to other vulnerabilities for more severe exploitation.

This vulnerability is particularly concerning because it requires no authentication and can be exploited remotely over the network. The J-Web interface is a web-based management tool that provides administrators with a graphical interface to configure and manage Junos devices, making it a high-value target for attackers seeking to compromise network infrastructure.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Attackers can chain this vulnerability with others to achieve remote code execution on vulnerable Juniper EX Series switches.

Affected Products

• Juniper Junos OS on EX Series - All versions prior to 20.4R3-S9
• Juniper Junos OS on EX Series - 21.1 versions 21.1R1 and later (no fix available for 21.1 branch)
• Juniper Junos OS on EX Series - 21.2 versions prior to 21.2R3-S7
• Juniper Junos OS on EX Series - 21.3 versions prior to 21.3R3-S5
• Juniper Junos OS on EX Series - 21.4 versions prior to 21.4R3-S5
• Juniper Junos OS on EX Series - 22.1 versions prior to 22.1R3-S4
• Juniper Junos OS on EX Series - 22.2 versions prior to 22.2R3-S2
• Juniper Junos OS on EX Series - 22.3 versions prior to 22.3R3-S1
• Juniper Junos OS on EX Series - 22.4 versions prior to 22.4R2-S2 or 22.4R3
• Juniper Junos OS on EX Series - 23.2 versions prior to 23.2R1-S1 or 23.2R2

Discovery Timeline

• August 17, 2023 - CVE-2023-36844 published to NVD
• October 24, 2025 - Last updated in NVD database

Technical Details for CVE-2023-36844

Vulnerability Analysis

The vulnerability resides in the J-Web interface's PHP implementation, which fails to properly sanitize and validate external input that controls environment variables. The J-Web component processes HTTP requests containing specially crafted parameters that can override PHP environment variables, allowing attackers to manipulate the execution context of the web application.

This type of vulnerability (CWE-473: PHP External Variable Modification) occurs when PHP's register_globals functionality or similar mechanisms allow external input to directly set internal variables. In the context of J-Web, this allows attackers to influence how PHP processes requests and interacts with the underlying system.

The network-accessible attack vector combined with the lack of authentication requirements makes this vulnerability particularly dangerous in enterprise environments where J-Web interfaces may be exposed to internal networks or, in some misconfigurations, to the internet.

Root Cause

The root cause of this vulnerability is improper input validation in the J-Web PHP application. The application fails to adequately sanitize user-supplied input before using it to set internal PHP environment variables. This allows attackers to inject malicious values through HTTP request parameters, effectively controlling application behavior.

PHP External Variable Modification vulnerabilities typically arise from:

• Legacy PHP configurations that automatically register global variables from user input
• Custom code that directly maps user input to internal variables without validation
• Improper use of PHP superglobals or variable-variable constructs

Attack Vector

The attack vector for CVE-2023-36844 is network-based and requires no authentication. An attacker can exploit this vulnerability by sending specially crafted HTTP requests to the J-Web interface. The exploitation process involves:

1. Identifying an exposed J-Web interface on port 443 (HTTPS) or port 80 (HTTP)
2. Crafting HTTP requests with parameters designed to modify PHP environment variables
3. Submitting the malicious requests to manipulate the application's execution context
4. Chaining the variable modification with other vulnerabilities to achieve more significant impact

While this vulnerability alone provides partial integrity impact, security researchers have demonstrated that it can be combined with other vulnerabilities (such as CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847) to achieve unauthenticated remote code execution. See the Packet Storm Security Advisory for technical details on the exploitation chain.

Detection Methods for CVE-2023-36844

Indicators of Compromise

• Unusual HTTP requests to J-Web interface containing unexpected parameters or malformed values attempting to set PHP variables
• Web server access logs showing requests with suspicious parameter names commonly associated with PHP variable manipulation (e.g., PHPRC, PHP_INI_SCAN_DIR, auto_prepend_file)
• Unexpected process execution or file creation on EX Series switches following J-Web access
• Authentication bypass attempts or unauthorized configuration changes on affected devices

Detection Strategies

• Implement network intrusion detection rules to identify HTTP requests targeting J-Web interfaces with known exploitation patterns
• Monitor web server logs on Juniper devices for requests containing unusual POST parameters or query strings
• Deploy web application firewall (WAF) rules to block requests attempting PHP environment variable manipulation
• Use vulnerability scanning tools to identify exposed J-Web interfaces and unpatched Junos versions

Monitoring Recommendations

• Enable detailed logging on J-Web interfaces and forward logs to a centralized SIEM for analysis
• Set up alerts for any external access attempts to J-Web management interfaces from untrusted networks
• Implement network segmentation monitoring to detect lateral movement following potential exploitation
• Regularly audit Juniper device configurations for unauthorized changes that may indicate compromise

How to Mitigate CVE-2023-36844

Immediate Actions Required

• Disable J-Web interface if not required for operations: delete system services web-management
• Restrict J-Web access to trusted management networks only using firewall rules or access control lists
• Apply the latest Junos OS security patches as specified in the Juniper Security Advisory JSA72300
• Audit systems for signs of compromise before and after applying patches

Patch Information

Juniper Networks has released patched versions of Junos OS that address this vulnerability. Organizations should upgrade to the following versions or later:

• 20.4R3-S9 for the 20.4 branch
• 21.2R3-S7 for the 21.2 branch
• 21.3R3-S5 for the 21.3 branch
• 21.4R3-S5 for the 21.4 branch
• 22.1R3-S4 for the 22.1 branch
• 22.2R3-S2 for the 22.2 branch
• 22.3R3-S1 for the 22.3 branch
• 22.4R2-S2 or 22.4R3 for the 22.4 branch
• 23.2R1-S1 or 23.2R2 for the 23.2 branch

Note: The 21.1 branch does not have a fix available; organizations using this version should migrate to a supported branch.

Refer to the official Juniper Security Advisory JSA72300 for detailed upgrade instructions and the latest patch availability.

Workarounds

• Disable J-Web entirely if the web management interface is not operationally required
• Implement strict access control lists (ACLs) to limit J-Web access to specific trusted IP addresses
• Use out-of-band management networks to isolate device management traffic from production networks
• Deploy a reverse proxy or WAF in front of J-Web interfaces to filter malicious requests

# Configuration example - Disable J-Web on Junos OS
configure
delete system services web-management
commit

# Alternative: Restrict J-Web access to specific management network
configure
set system services web-management https interface fxp0.0
set firewall filter MGMT-ACCESS term ALLOW-JWEB from source-prefix-list TRUSTED-MGMT
set firewall filter MGMT-ACCESS term ALLOW-JWEB from protocol tcp
set firewall filter MGMT-ACCESS term ALLOW-JWEB from destination-port https
set firewall filter MGMT-ACCESS term ALLOW-JWEB then accept
set firewall filter MGMT-ACCESS term DENY-ALL then discard
set interfaces fxp0 unit 0 family inet filter input MGMT-ACCESS
commit