PT-2023-4586 · Juniper Networks · J-Web+1
Published
2023-08-17
·
Updated
2025-10-24
·
CVE-2023-36844
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Juniper Networks Junos OS on EX Series versions prior to 20.4R3-S9
Juniper Networks Junos OS on EX Series version 21.1R1 and later
Juniper Networks Junos OS on EX Series versions prior to 21.2R3-S7
Juniper Networks Junos OS on EX Series versions prior to 21.3R3-S5
Juniper Networks Junos OS on EX Series versions prior to 21.4R3-S5
Juniper Networks Junos OS on EX Series versions prior to 22.1R3-S4
Juniper Networks Junos OS on EX Series versions prior to 22.2R3-S2
Juniper Networks Junos OS on EX Series versions prior to 22.3R3-S1
Juniper Networks Junos OS on EX Series versions prior to 22.4R2-S2, 22.4R3
Juniper Networks Junos OS on EX Series versions prior to 23.2R1-S1, 23.2R2
Description
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request, an attacker is able to modify certain PHP environment variables, leading to partial loss of integrity, which may allow chaining to other vulnerabilities. This issue may be exploited to achieve remote code execution (RCE) in Juniper devices. Exploitation attempts have been observed, and proof-of-concept (PoC) code is available. The "/webauth operation.php" endpoint is targeted in these attacks.
Recommendations
For versions prior to 20.4R3-S9, update to version 20.4R3-S9 or later.
For version 21.1R1 and later, update to a version that is not affected.
For versions prior to 21.2R3-S7, update to version 21.2R3-S7 or later.
For versions prior to 21.3R3-S5, update to version 21.3R3-S5 or later.
For versions prior to 21.4R3-S5, update to version 21.4R3-S5 or later.
For versions prior to 22.1R3-S4, update to version 22.1R3-S4 or later.
For versions prior to 22.2R3-S2, update to version 22.2R3-S2 or later.
For versions prior to 22.3R3-S1, update to version 22.3R3-S1 or later.
For versions prior to 22.4R2-S2, 22.4R3, update to a version that is not affected.
For versions prior to 23.2R1-S1, 23.2R2, update to a version that is not affected.
As a temporary workaround, consider disabling the J-Web interface until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the targeted endpoint until the issue is resolved.
Exploit
Fix
RCE
Unrestricted File Upload
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
J-Web
Junos