CVE-2023-36846: Juniper Junos Auth Bypass Vulnerability

CVE-2023-36846 Overview

CVE-2023-36846 is a Missing Authentication for Critical Function vulnerability affecting Juniper Networks Junos OS on SRX Series firewalls. This security flaw allows an unauthenticated, network-based attacker to upload arbitrary files via the J-Web management interface, causing limited impact to file system integrity.

The vulnerability exists in the user.php endpoint, which fails to enforce authentication for certain requests. Attackers can exploit this weakness to upload malicious files without providing valid credentials, potentially enabling further attack chains when combined with other vulnerabilities.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Organizations with exposed J-Web interfaces are at immediate risk of compromise.

Affected Products

• Juniper Networks Junos OS (all versions prior to 20.4R3-S8)
• Juniper Networks Junos OS 21.1 versions 21.1R1 and later
• Juniper Networks Junos OS 21.2 versions prior to 21.2R3-S6
• Juniper Networks Junos OS 21.3 versions prior to 21.3R3-S5
• Juniper Networks Junos OS 21.4 versions prior to 21.4R3-S5
• Juniper Networks Junos OS 22.1 versions prior to 22.1R3-S3
• Juniper Networks Junos OS 22.2 versions prior to 22.2R3-S2
• Juniper Networks Junos OS 22.3 versions prior to 22.3R2-S2, 22.3R3
• Juniper Networks Junos OS 22.4 versions prior to 22.4R2-S1, 22.4R3
• Juniper SRX Series firewalls (SRX100, SRX110, SRX210, SRX220, SRX240, SRX300, SRX320, SRX340, SRX345, SRX380, SRX550, SRX650, SRX1400, SRX1500, SRX3400, SRX3600, SRX4000, SRX4100, SRX4200, SRX4600, SRX5000, SRX5400, SRX5600, SRX5800)

Discovery Timeline

• August 17, 2023 - CVE-2023-36846 published to NVD
• October 24, 2025 - Last updated in NVD database

Technical Details for CVE-2023-36846

Vulnerability Analysis

This vulnerability is classified as CWE-306 (Missing Authentication for Critical Function). The J-Web management interface on Juniper SRX Series firewalls contains an authentication bypass that allows unauthenticated attackers to reach the user.php endpoint and upload arbitrary files to the device's file system.

The vulnerability requires no user interaction and can be exploited remotely over the network. While the direct impact is limited to file system integrity (files can be written but not read or executed through this vulnerability alone), the real danger lies in chaining this flaw with other vulnerabilities to achieve more significant compromise.

This vulnerability has been confirmed as actively exploited in the wild, with CISA adding it to their Known Exploited Vulnerabilities catalog, indicating threat actors are leveraging this flaw in real-world attacks against organizations running vulnerable Juniper devices.

Root Cause

The root cause of CVE-2023-36846 is a failure to implement proper authentication checks on the user.php endpoint within the J-Web management interface. This endpoint processes file upload requests without verifying whether the requester has provided valid credentials or has an authenticated session.

This design flaw allows anyone with network access to the J-Web interface to send crafted HTTP requests that bypass the normal authentication workflow and directly invoke file upload functionality.

Attack Vector

The attack vector is network-based, targeting the J-Web management interface typically accessible on ports 80 (HTTP) or 443 (HTTPS). An attacker sends a specially crafted HTTP request to the user.php endpoint that exploits the missing authentication check.

The attack flow involves identifying SRX devices with exposed J-Web interfaces, crafting malicious HTTP POST requests targeting the vulnerable user.php endpoint without authentication credentials, uploading arbitrary files to controlled locations on the file system, and potentially chaining with other vulnerabilities (such as CVE-2023-36845) to achieve remote code execution.

The vulnerability requires no special privileges and can be exploited with standard HTTP tools. See the Juniper Support Advisory JSA72300 for complete technical details.

Detection Methods for CVE-2023-36846

Indicators of Compromise

• Unexpected files appearing in writable directories on SRX devices, particularly /var/tmp/ or similar locations
• HTTP POST requests to /user.php or related J-Web endpoints from unauthenticated sources
• Web server logs showing requests to J-Web management interface from external or unexpected IP addresses
• Anomalous file system activity or modifications on SRX devices without corresponding administrative actions

Detection Strategies

• Monitor web server access logs for unauthenticated requests to /user.php and related J-Web endpoints
• Implement network-based intrusion detection rules to identify suspicious HTTP POST requests to Juniper J-Web interfaces
• Deploy SentinelOne Singularity XDR to detect and correlate suspicious network activity targeting network infrastructure devices
• Use asset inventory tools to identify all Juniper SRX devices with exposed J-Web interfaces

Monitoring Recommendations

• Enable comprehensive logging on all J-Web management interfaces and forward logs to centralized SIEM
• Configure alerts for any unauthenticated access attempts to management interfaces
• Implement network flow monitoring to detect unusual traffic patterns to SRX device management ports
• Regularly audit file system integrity on SRX devices to identify unauthorized modifications

How to Mitigate CVE-2023-36846

Immediate Actions Required

• Disable J-Web interface if not required using the CLI command delete system services web-management
• Restrict J-Web access to trusted management networks only using firewall rules or access control lists
• Review and audit all SRX devices for signs of compromise before and after patching
• Apply Juniper security patches immediately to all affected SRX Series devices

Patch Information

Juniper Networks has released patches addressing this vulnerability. Organizations should upgrade to the following fixed versions based on their current release train:

• 20.4 branch: Upgrade to 20.4R3-S8 or later
• 21.2 branch: Upgrade to 21.2R3-S6 or later
• 21.3 branch: Upgrade to 21.3R3-S5 or later
• 21.4 branch: Upgrade to 21.4R3-S5 or later
• 22.1 branch: Upgrade to 22.1R3-S3 or later
• 22.2 branch: Upgrade to 22.2R3-S2 or later
• 22.3 branch: Upgrade to 22.3R2-S2, 22.3R3, or later
• 22.4 branch: Upgrade to 22.4R2-S1, 22.4R3, or later

Note: Junos OS 21.1 versions have no fix available; upgrade to a supported release branch.

For complete patch information, refer to the Juniper Support Advisory JSA72300.

Workarounds

• Disable J-Web entirely if the web management interface is not operationally required
• Implement strict network segmentation to isolate management interfaces from untrusted networks
• Use out-of-band management networks for all administrative access to SRX devices
• Deploy a jump host or bastion server for accessing J-Web interfaces rather than exposing them directly

# Disable J-Web interface on Juniper SRX devices
configure
delete system services web-management
commit

# Alternative: Restrict J-Web access to specific trusted hosts
configure
set system services web-management https interface fxp0.0
set system services web-management https local-certificate <certificate-name>
set firewall filter MGMT-ACCESS term ALLOW-JWEB from source-address 10.0.0.0/8
set firewall filter MGMT-ACCESS term ALLOW-JWEB from protocol tcp
set firewall filter MGMT-ACCESS term ALLOW-JWEB from destination-port https
set firewall filter MGMT-ACCESS term ALLOW-JWEB then accept
set firewall filter MGMT-ACCESS term DENY-ALL then discard
commit