PT-2023-4682 · Juniper Networks · Junos

Published 2023-08-17 · Updated 2025-10-24 · CVE-2023-36847

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Juniper Networks Junos OS on EX Series versions prior to 20.4R3-S8 Juniper Networks Junos OS on EX Series version 21.1R1 and later Juniper Networks Junos OS on EX Series versions prior to 21.2R3-S6 Juniper Networks Junos OS on EX Series versions prior to 21.3R3-S5 Juniper Networks Junos OS on EX Series versions prior to 21.4R3-S4 Juniper Networks Junos OS on EX Series versions prior to 22.1R3-S3 Juniper Networks Junos OS on EX Series versions prior to 22.2R3-S1 Juniper Networks Junos OS on EX Series versions prior to 22.3R2-S2, 22.3R3 Juniper Networks Junos OS on EX Series versions prior to 22.4R2-S1, 22.4R3

Description A Missing Authentication for Critical Function issue in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.

Recommendations For versions prior to 20.4R3-S8, update to version 20.4R3-S8 or later. For version 21.1R1 and later, update to a version that includes the fix for this issue. For versions prior to 21.2R3-S6, update to version 21.2R3-S6 or later. For versions prior to 21.3R3-S5, update to version 21.3R3-S5 or later. For versions prior to 21.4R3-S4, update to version 21.4R3-S4 or later. For versions prior to 22.1R3-S3, update to version 22.1R3-S3 or later. For versions prior to 22.2R3-S1, update to version 22.2R3-S1 or later. For versions prior to 22.3R2-S2, 22.3R3, update to version 22.3R2-S2, 22.3R3 or later. For versions prior to 22.4R2-S1, 22.4R3, update to version 22.4R2-S1, 22.4R3 or later. As a temporary workaround, consider restricting access to the installAppPackage.php endpoint until a patch is available.

Exploit

Fix

Missing Authentication

Unrestricted File Upload

Weakness Enumeration

CWE-306

CWE-434

Related Identifiers

BDU:2023-05099

CVE-2023-36847

Affected Products

Junos

References · 42

• 🔥❌ https://github.com/watchtowrlabs/juniper-rce_cve-2023-36847 · Exploit, Deleted
• https://supportportal.juniper.net/JSA72300 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-36847 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-05099 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-36847 · Security Note
• https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US · Security Note
• https://twitter.com/cyber_advising/status/1695402248228966868 · Twitter Post
• https://twitter.com/cipherstorm/status/1693921844339126758 · Twitter Post
• https://twitter.com/ohhara_shiojiri/status/1724237800449708221 · Twitter Post
• https://t.me/p0x3k/1544 · Telegram Post
• https://twitter.com/CVEnew/status/1692259617315705142 · Twitter Post
• https://twitter.com/MostExploited/status/1724394736843128849 · Twitter Post
• https://twitter.com/fletch_ai/status/1693837146451271722 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1692308972458402050 · Twitter Post
• https://twitter.com/fletch_ai/status/1696388965530493292 · Twitter Post