CVE-2023-36846: Juniper Junos Auth Bypass Vulnerability

CVE-2023-36846 Overview

CVE-2023-36846 is a Missing Authentication for Critical Function vulnerability [CWE-306] in Juniper Networks Junos OS on SRX Series devices. An unauthenticated, network-based attacker can send a specific request to user.php through the J-Web interface to upload arbitrary files without authentication. This action causes a loss of integrity for a portion of the file system and enables chaining with other Junos vulnerabilities to achieve remote code execution. CISA added this vulnerability to the Known Exploited Vulnerabilities (KEV) Catalog after confirmed in-the-wild exploitation against internet-exposed SRX firewalls. The EPSS score is 94.28% (99.94 percentile), indicating active exploitation likelihood.

Critical Impact

Unauthenticated remote attackers can upload arbitrary files to SRX Series firewalls via J-Web, enabling chained exploitation that has been observed in the wild.

Affected Products

• Juniper Junos OS on SRX Series — all versions prior to 20.4R3-S8
• Juniper Junos OS on SRX Series — 21.1 versions 21.1R1 and later; 21.2 prior to 21.2R3-S6; 21.3 prior to 21.3R3-S5; 21.4 prior to 21.4R3-S5
• Juniper Junos OS on SRX Series — 22.1 prior to 22.1R3-S3; 22.2 prior to 22.2R3-S2; 22.3 prior to 22.3R2-S2/22.3R3; 22.4 prior to 22.4R2-S1/22.4R3

Discovery Timeline

• 2023-08-17 - CVE-2023-36846 published to NVD
• 2023-08-17 - Juniper releases security advisory JSA72300
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2023-36846

Vulnerability Analysis

The vulnerability resides in the J-Web management interface bundled with Junos OS on SRX Series firewalls. J-Web exposes a PHP-based administrative web application. The user.php script lacks authentication checks for certain request types, allowing remote attackers to invoke file upload functionality without supplying credentials.

An attacker sends a crafted HTTP POST request to user.php and writes arbitrary files to disk on the firewall. The uploaded content lands in a location accessible to subsequent J-Web requests. While the impact in isolation is limited to file system integrity, the upload primitive is regularly chained with CVE-2023-36845 to achieve unauthenticated remote code execution on the device.

Root Cause

The root cause is a missing authentication check on a critical PHP endpoint within J-Web [CWE-306]. The user.php handler accepts file upload parameters without first validating that the requesting session is authenticated. The application logic incorrectly assumes that callers of this code path are already authorized.

Attack Vector

Exploitation requires only network access to the J-Web management interface, typically over HTTPS on port 443 or HTTP on port 80. The attacker issues an unauthenticated HTTP request to /user.php containing multipart form data with an attacker-controlled file. The Junos PHP runtime stores the uploaded file under a path the attacker can later reference. Public exploit code combines this primitive with CVE-2023-36845 to overwrite PHPRC environment variables and load attacker-supplied PHP, yielding remote code execution as the J-Web service user.

No authenticated exploitation code is required, no user interaction is needed, and the attack succeeds in a single request chain. For technical details and patch notes, consult the Juniper Security Advisory JSA72300.

Detection Methods for CVE-2023-36846

Indicators of Compromise

• Unauthenticated HTTP/HTTPS POST requests to /user.php on SRX Series J-Web interfaces, especially with multipart form-data uploads
• Unexpected files written under J-Web temporary or upload directories on the firewall
• Subsequent requests referencing PHPRC or auto_prepend_file parameters indicating chaining with CVE-2023-36845
• New PHP files appearing on disk that were not deployed by administrators

Detection Strategies

• Inspect web server and J-Web access logs for POST requests to user.php from unauthenticated sessions or unfamiliar source IPs
• Deploy IDS/IPS signatures targeting the documented exploit chain combining user.php uploads with PHPRC manipulation
• Monitor outbound connections from the SRX management plane that could indicate post-exploitation command-and-control activity

Monitoring Recommendations

• Forward Junos syslog and J-Web access logs to a centralized SIEM for correlation and retention
• Alert on any internet-sourced traffic reaching the J-Web management interface
• Track file integrity for J-Web web-root directories and flag new or modified PHP files

How to Mitigate CVE-2023-36846

Immediate Actions Required

• Upgrade affected SRX Series devices to a fixed Junos OS release listed in Juniper Security Advisory JSA72300
• Disable J-Web on devices where the web management interface is not required
• Restrict J-Web access to trusted management networks using firewall filters or out-of-band management
• Audit SRX devices for signs of prior compromise given confirmed in-the-wild exploitation per the CISA KEV Catalog

Patch Information

Juniper has released fixed software in Junos OS versions 20.4R3-S8, 21.2R3-S6, 21.3R3-S5, 21.4R3-S5, 22.1R3-S3, 22.2R3-S2, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3, and all subsequent releases. Refer to the Juniper Security Advisory JSA72300 for the complete fix matrix.

Workarounds

• Disable J-Web entirely with the delete system services web-management configuration if the interface is not in use
• Limit J-Web access to a defined administrative source-address list using Junos firewall filters on the loopback interface
• Place the SRX management interface on an out-of-band network that is not reachable from untrusted segments

# Example: restrict or disable J-Web on Junos SRX
# Disable J-Web entirely
delete system services web-management http
delete system services web-management https

# Or restrict to a trusted management prefix via firewall filter
set firewall family inet filter PROTECT-RE term ALLOW-JWEB from source-address 10.0.0.0/24
set firewall family inet filter PROTECT-RE term ALLOW-JWEB from destination-port [80 443]
set firewall family inet filter PROTECT-RE term ALLOW-JWEB then accept
set firewall family inet filter PROTECT-RE term BLOCK-JWEB from destination-port [80 443]
set firewall family inet filter PROTECT-RE term BLOCK-JWEB then discard
set interfaces lo0 unit 0 family inet filter input PROTECT-RE
commit