CVE-2023-36845: Juniper Junos J-Web RCE Vulnerability

CVE-2023-36845 Overview

CVE-2023-36845 is a PHP External Variable Modification vulnerability affecting the J-Web interface in Juniper Networks Junos OS running on EX Series switches and SRX Series firewalls. This vulnerability enables an unauthenticated, network-based attacker to achieve remote code execution by manipulating the PHP execution environment through crafted HTTP requests.

The vulnerability stems from improper handling of the PHPRC environment variable, which allows attackers to specify a custom PHP configuration file. By injecting malicious PHP directives through this mechanism, an attacker can execute arbitrary code on the affected device without requiring any authentication credentials.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Unauthenticated remote attackers can achieve complete system compromise on affected Juniper devices, potentially gaining control over critical network infrastructure.

Affected Products

• Juniper Junos OS on EX Series (All versions prior to 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S2, 22.3R2-S2/22.3R3-S1, 22.4R2-S1/22.4R3, 23.2R1-S1/23.2R2)
• Juniper Junos OS on SRX Series including SRX100, SRX110, SRX210, SRX220, SRX240, SRX300, SRX320, SRX340, SRX345, SRX380, SRX550, SRX650
• Juniper Junos OS on SRX Series including SRX1400, SRX1500, SRX3400, SRX3600, SRX4000, SRX4100, SRX4200, SRX4600, SRX5000, SRX5400, SRX5600, SRX5800

Discovery Timeline

• August 17, 2023 - CVE-2023-36845 published to NVD
• October 24, 2025 - Last updated in NVD database

Technical Details for CVE-2023-36845

Vulnerability Analysis

This vulnerability exploits a fundamental weakness in how the J-Web interface handles PHP environment variables. The J-Web management interface, which provides web-based administration for Junos OS devices, utilizes PHP for server-side processing. The vulnerability allows an attacker to manipulate the PHPRC environment variable through specially crafted HTTP requests, effectively taking control of PHP's configuration.

When exploited, the attacker can specify a custom php.ini configuration file location, enabling them to inject arbitrary PHP directives. This includes the ability to modify critical settings such as auto_prepend_file or auto_append_file, which can be leveraged to execute malicious PHP code before or after the normal script execution. The attack requires no prior authentication, making it particularly dangerous for internet-facing J-Web interfaces.

The impact extends beyond simple code execution—successful exploitation grants attackers the same privileges as the J-Web service, which typically runs with elevated permissions on Juniper devices. This can lead to complete device takeover, network reconnaissance, lateral movement, or denial of service attacks against critical network infrastructure.

Root Cause

The root cause lies in improper input validation and insufficient restrictions on external variable modification within the J-Web PHP execution environment. The application fails to properly sanitize or restrict the PHPRC environment variable, which is supposed to be controlled by the system administrator rather than being modifiable through user input.

PHP's design allows the PHPRC variable to override the default location of the configuration file. By accepting this variable from untrusted input without validation, the J-Web interface inadvertently allows attackers to hijack the PHP runtime configuration, leading to arbitrary code injection and execution.

Attack Vector

The attack is executed over the network against the J-Web management interface. An attacker sends a crafted HTTP request to the vulnerable J-Web endpoint that includes the PHPRC variable set to a path controlled by the attacker. This path typically points to a malicious PHP configuration file that has been uploaded or is accessible to the PHP process.

The malicious configuration file contains directives that cause PHP to execute attacker-controlled code. Common techniques include using auto_prepend_file to include a malicious PHP payload that gets executed before the legitimate script runs. Since no authentication is required, any attacker with network access to the J-Web interface can exploit this vulnerability.

The exploitation typically follows this pattern: the attacker first identifies a Juniper device with J-Web exposed, then crafts a request that sets the PHPRC variable to point to a malicious configuration, and finally triggers the execution of PHP code that provides shell access or executes arbitrary commands on the underlying operating system.

Detection Methods for CVE-2023-36845

Indicators of Compromise

• Unusual HTTP requests to J-Web interface containing PHPRC variable manipulation in request parameters or headers
• Unexpected PHP configuration file access attempts in web server logs, particularly to non-standard paths
• Anomalous process spawning from PHP or httpd processes on Juniper devices
• Unauthorized configuration changes or new user accounts on affected devices
• Network connections from Juniper devices to unknown external IP addresses, particularly on non-standard ports

Detection Strategies

• Monitor J-Web access logs for requests containing suspicious environment variable manipulation patterns, particularly PHPRC references
• Implement network-based intrusion detection rules to identify exploitation attempts against vulnerable J-Web endpoints
• Deploy SentinelOne agents where applicable to detect post-exploitation activities and anomalous process behaviors
• Review Juniper device audit logs for unauthorized CLI access or configuration modifications following J-Web interactions

Monitoring Recommendations

• Configure SIEM alerting for any access attempts to J-Web interfaces from untrusted networks or IP ranges
• Implement network segmentation monitoring to detect lateral movement from compromised Juniper devices
• Enable verbose logging on J-Web interfaces and forward logs to centralized security monitoring infrastructure
• Establish baseline behavior for J-Web access patterns and alert on deviations

How to Mitigate CVE-2023-36845

Immediate Actions Required

• Disable J-Web interface immediately if not required for operations using CLI command delete system services web-management
• Apply network access controls to restrict J-Web access to trusted management networks only
• Update affected Juniper devices to patched versions as soon as possible following change management procedures
• Audit all Juniper EX and SRX devices to identify those running vulnerable Junos OS versions
• Review device configurations and user accounts for any signs of unauthorized modifications

Patch Information

Juniper Networks has released security patches addressing this vulnerability. Organizations should upgrade to the following fixed versions:

• Junos OS 20.4: Upgrade to 20.4R3-S9 or later
• Junos OS 21.2: Upgrade to 21.2R3-S7 or later
• Junos OS 21.3: Upgrade to 21.3R3-S5 or later
• Junos OS 21.4: Upgrade to 21.4R3-S5 or later
• Junos OS 22.1: Upgrade to 22.1R3-S4 or later
• Junos OS 22.2: Upgrade to 22.2R3-S2 or later
• Junos OS 22.3: Upgrade to 22.3R2-S2, 22.3R3-S1, or later
• Junos OS 22.4: Upgrade to 22.4R2-S1, 22.4R3, or later
• Junos OS 23.2: Upgrade to 23.2R1-S1, 23.2R2, or later

Note: Junos OS 21.1 branch is end-of-life; organizations should migrate to a supported version. Consult the Juniper Security Advisory JSA72300 for complete patch information.

Workarounds

• Disable J-Web interface entirely using CLI: delete system services web-management followed by commit
• Implement strict firewall rules to block access to J-Web from untrusted networks (default ports TCP/80 and TCP/443)
• Use out-of-band management networks for device administration instead of in-band J-Web access
• Deploy a reverse proxy with strong authentication in front of J-Web if it must remain accessible

# Junos CLI commands to disable J-Web interface
configure
delete system services web-management
commit and-quit

# Alternative: Restrict J-Web access to specific trusted hosts
configure
set system services web-management https interface fxp0.0
set firewall filter mgmt-access term allow-jweb from source-address 10.0.0.0/8
set firewall filter mgmt-access term allow-jweb then accept
set firewall filter mgmt-access term deny-all then reject
commit and-quit