CVE-2023-36847: Juniper Junos Auth Bypass Vulnerability

CVE-2023-36847 Overview

CVE-2023-36847 is a Missing Authentication for Critical Function vulnerability affecting Juniper Networks Junos OS on EX Series switches. This vulnerability allows an unauthenticated, network-based attacker to upload arbitrary files via the J-Web management interface, specifically through the installAppPackage.php endpoint which lacks proper authentication controls.

The vulnerability enables attackers to compromise file system integrity without requiring any credentials, making it particularly dangerous for organizations with internet-exposed J-Web interfaces. This flaw can potentially be chained with other vulnerabilities to achieve more severe impacts on affected systems.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Unauthenticated attackers can upload arbitrary files to EX Series switches via the J-Web interface, potentially enabling further compromise through exploit chaining.

Affected Products

• Juniper Networks Junos OS on EX Series - All versions prior to 20.4R3-S8
• Juniper Networks Junos OS on EX Series - 21.1 versions 21.1R1 and later (no fix available)
• Juniper Networks Junos OS on EX Series - 21.2 versions prior to 21.2R3-S6
• Juniper Networks Junos OS on EX Series - 21.3 versions prior to 21.3R3-S5
• Juniper Networks Junos OS on EX Series - 21.4 versions prior to 21.4R3-S4
• Juniper Networks Junos OS on EX Series - 22.1 versions prior to 22.1R3-S3
• Juniper Networks Junos OS on EX Series - 22.2 versions prior to 22.2R3-S1
• Juniper Networks Junos OS on EX Series - 22.3 versions prior to 22.3R2-S2, 22.3R3
• Juniper Networks Junos OS on EX Series - 22.4 versions prior to 22.4R2-S1, 22.4R3

Discovery Timeline

• August 17, 2023 - CVE-2023-36847 published to NVD
• October 24, 2025 - Last updated in NVD database

Technical Details for CVE-2023-36847

Vulnerability Analysis

This vulnerability stems from a Missing Authentication for Critical Function weakness (CWE-306) in the J-Web management interface of Junos OS. The installAppPackage.php endpoint, designed for application package installation, fails to enforce authentication checks before processing file upload requests. This architectural flaw allows any network-reachable attacker to interact with this endpoint without providing valid credentials.

The impact is focused on file system integrity compromise. While the vulnerability itself provides limited direct access, the ability to upload arbitrary files to specific locations on the switch creates opportunities for exploit chaining. Attackers could potentially upload malicious configuration files, scripts, or other content that could be leveraged through subsequent vulnerabilities or misconfigurations.

Root Cause

The root cause is the absence of authentication enforcement on the installAppPackage.php endpoint within the J-Web interface. This PHP script processes file upload requests but does not validate that the requesting user has authenticated to the management interface before accepting and writing files to the system. This represents a fundamental design flaw where a critical administrative function was exposed without proper access controls.

Attack Vector

The attack requires network access to the J-Web management interface, typically exposed on HTTPS port 443. An attacker crafts a specially formatted HTTP POST request targeting the installAppPackage.php endpoint with an arbitrary file payload. The request bypasses authentication checks entirely, allowing the file to be written to the file system.

The attack flow involves:

1. Identifying an EX Series switch with J-Web interface exposed
2. Sending an unauthenticated POST request to installAppPackage.php
3. Including an arbitrary file in the request payload
4. The file is written to the system without credential validation
5. The uploaded file can then potentially be leveraged for further exploitation

Detection Methods for CVE-2023-36847

Indicators of Compromise

• Unexpected HTTP POST requests to /installAppPackage.php from untrusted IP addresses
• Unusual file modifications or new files appearing in J-Web application directories
• Web server access logs showing unauthenticated requests to the vulnerable endpoint
• Unexpected configuration changes or system behavior following J-Web access

Detection Strategies

• Monitor web server logs for POST requests to installAppPackage.php without preceding authentication events
• Implement network-level monitoring for connections to J-Web interface from unauthorized sources
• Deploy file integrity monitoring on EX Series switches to detect unauthorized file uploads
• Review firewall logs for unusual traffic patterns targeting management interface ports

Monitoring Recommendations

• Enable detailed logging on J-Web interface to capture all HTTP requests with source IP information
• Configure SIEM alerts for any access attempts to installAppPackage.php endpoint
• Implement network segmentation monitoring to detect management plane access from untrusted networks
• Establish baseline behavior for J-Web access patterns to identify anomalous activity

How to Mitigate CVE-2023-36847

Immediate Actions Required

• Disable J-Web interface if not operationally required using delete system services web-management
• Restrict J-Web access to trusted management networks only via firewall rules
• Review access logs for any historical exploitation attempts against the vulnerable endpoint
• Implement out-of-band management network isolation for switch administration

Patch Information

Juniper Networks has released patched versions of Junos OS to address this vulnerability. Organizations should upgrade to the following fixed versions based on their current release train:

• Version 20.4R3-S8 or later for 20.4 branch
• Version 21.2R3-S6 or later for 21.2 branch
• Version 21.3R3-S5 or later for 21.3 branch
• Version 21.4R3-S4 or later for 21.4 branch
• Version 22.1R3-S3 or later for 22.1 branch
• Version 22.2R3-S1 or later for 22.2 branch
• Version 22.3R2-S2, 22.3R3 or later for 22.3 branch
• Version 22.4R2-S1, 22.4R3 or later for 22.4 branch

Note: The 21.1 branch has no available fix; migration to a supported version is required.

For detailed patch information, refer to the Juniper Security Advisory JSA72300.

Workarounds

• Disable J-Web entirely if web-based management is not required for operations
• Implement strict access control lists (ACLs) limiting J-Web access to specific management workstations
• Use CLI-based management via SSH as an alternative to the web interface
• Deploy a jump host architecture requiring VPN authentication before reaching management interfaces

# Disable J-Web interface on Junos OS
configure
delete system services web-management
commit

# Alternative: Restrict J-Web to specific management network
configure
set system services web-management https interface fxp0.0
set firewall filter MGMT-ACCESS term ALLOW-MGMT from source-address 10.0.0.0/24
set firewall filter MGMT-ACCESS term ALLOW-MGMT then accept
set firewall filter MGMT-ACCESS term DENY-ALL then discard
set interfaces fxp0 unit 0 family inet filter input MGMT-ACCESS
commit