CVE-2023-36847: Juniper Junos Auth Bypass Vulnerability

CVE-2023-36847 Overview

CVE-2023-36847 is a Missing Authentication for Critical Function vulnerability affecting Juniper Networks Junos OS on EX Series switches. This vulnerability allows an unauthenticated, network-based attacker to upload arbitrary files via the J-Web management interface, specifically through the installAppPackage.php endpoint which lacks proper authentication controls.

The vulnerability enables attackers to compromise file system integrity without requiring any credentials, making it particularly dangerous for organizations with internet-exposed J-Web interfaces. This flaw can potentially be chained with other vulnerabilities to achieve more severe impacts on affected systems.

Critical Impact
This vulnerability is actively exploited in the wild and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Unauthenticated attackers can upload arbitrary files to EX Series switches via the J-Web interface, potentially enabling further compromise through exploit chaining.

Affected Products

Juniper Networks Junos OS on EX Series - All versions prior to 20.4R3-S8
Juniper Networks Junos OS on EX Series - 21.1 versions 21.1R1 and later (no fix available)
Juniper Networks Junos OS on EX Series - 21.2 versions prior to 21.2R3-S6
Juniper Networks Junos OS on EX Series - 21.3 versions prior to 21.3R3-S5
Juniper Networks Junos OS on EX Series - 21.4 versions prior to 21.4R3-S4
Juniper Networks Junos OS on EX Series - 22.1 versions prior to 22.1R3-S3
Juniper Networks Junos OS on EX Series - 22.2 versions prior to 22.2R3-S1
Juniper Networks Junos OS on EX Series - 22.3 versions prior to 22.3R2-S2, 22.3R3
Juniper Networks Junos OS on EX Series - 22.4 versions prior to 22.4R2-S1, 22.4R3

Discovery Timeline

August 17, 2023 - CVE-2023-36847 published to NVD
October 24, 2025 - Last updated in NVD database

Technical Details for CVE-2023-36847

Vulnerability Analysis

This vulnerability stems from a Missing Authentication for Critical Function weakness (CWE-306) in the J-Web management interface of Junos OS. The installAppPackage.php endpoint, designed for application package installation, fails to enforce authentication checks before processing file upload requests. This architectural flaw allows any network-reachable attacker to interact with this endpoint without providing valid credentials.

The impact is focused on file system integrity compromise. While the vulnerability itself provides limited direct access, the ability to upload arbitrary files to specific locations on the switch creates opportunities for exploit chaining. Attackers could potentially upload malicious configuration files, scripts, or other content that could be leveraged through subsequent vulnerabilities or misconfigurations.

Root Cause

The root cause is the absence of authentication enforcement on the installAppPackage.php endpoint within the J-Web interface. This PHP script processes file upload requests but does not validate that the requesting user has authenticated to the management interface before accepting and writing files to the system. This represents a fundamental design flaw where a critical administrative function was exposed without proper access controls.

Attack Vector

The attack requires network access to the J-Web management interface, typically exposed on HTTPS port 443. An attacker crafts a specially formatted HTTP POST request targeting the installAppPackage.php endpoint with an arbitrary file payload. The request bypasses authentication checks entirely, allowing the file to be written to the file system.

The attack flow involves:

Identifying an EX Series switch with J-Web interface exposed
Sending an unauthenticated POST request to installAppPackage.php
Including an arbitrary file in the request payload
The file is written to the system without credential validation
The uploaded file can then potentially be leveraged for further exploitation

Detection Methods for CVE-2023-36847

Indicators of Compromise

Unexpected HTTP POST requests to /installAppPackage.php from untrusted IP addresses
Unusual file modifications or new files appearing in J-Web application directories
Web server access logs showing unauthenticated requests to the vulnerable endpoint
Unexpected configuration changes or system behavior following J-Web access

Detection Strategies

Monitor web server logs for POST requests to installAppPackage.php without preceding authentication events
Implement network-level monitoring for connections to J-Web interface from unauthorized sources
Deploy file integrity monitoring on EX Series switches to detect unauthorized file uploads
Review firewall logs for unusual traffic patterns targeting management interface ports

Monitoring Recommendations

Enable detailed logging on J-Web interface to capture all HTTP requests with source IP information
Configure SIEM alerts for any access attempts to installAppPackage.php endpoint
Implement network segmentation monitoring to detect management plane access from untrusted networks
Establish baseline behavior for J-Web access patterns to identify anomalous activity

How to Mitigate CVE-2023-36847

Immediate Actions Required

Disable J-Web interface if not operationally required using delete system services web-management
Restrict J-Web access to trusted management networks only via firewall rules
Review access logs for any historical exploitation attempts against the vulnerable endpoint
Implement out-of-band management network isolation for switch administration

Patch Information

Juniper Networks has released patched versions of Junos OS to address this vulnerability. Organizations should upgrade to the following fixed versions based on their current release train:

Version 20.4R3-S8 or later for 20.4 branch
Version 21.2R3-S6 or later for 21.2 branch
Version 21.3R3-S5 or later for 21.3 branch
Version 21.4R3-S4 or later for 21.4 branch
Version 22.1R3-S3 or later for 22.1 branch
Version 22.2R3-S1 or later for 22.2 branch
Version 22.3R2-S2, 22.3R3 or later for 22.3 branch
Version 22.4R2-S1, 22.4R3 or later for 22.4 branch

Note: The 21.1 branch has no available fix; migration to a supported version is required.

For detailed patch information, refer to the Juniper Security Advisory JSA72300.

Workarounds

Disable J-Web entirely if web-based management is not required for operations
Implement strict access control lists (ACLs) limiting J-Web access to specific management workstations
Use CLI-based management via SSH as an alternative to the web interface
Deploy a jump host architecture requiring VPN authentication before reaching management interfaces

bash

# Disable J-Web interface on Junos OS
configure
delete system services web-management
commit

# Alternative: Restrict J-Web to specific management network
configure
set system services web-management https interface fxp0.0
set firewall filter MGMT-ACCESS term ALLOW-MGMT from source-address 10.0.0.0/24
set firewall filter MGMT-ACCESS term ALLOW-MGMT then accept
set firewall filter MGMT-ACCESS term DENY-ALL then discard
set interfaces fxp0 unit 0 family inet filter input MGMT-ACCESS
commit