Juniper J-Web PHP Environment Variable Manipulation RCE Chain
- Product
- Juniper Networks Junos OS J-Web (SRX / EX)
- CVE
- CVE-2023-36844CVE-2023-36845CVE-2023-36846CVE-2023-36847
- Disclosed
- 2023-08-17
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Junos OS on SRX and EX: all before 20.4R3-S8, 21.2 before 21.2R3-S6, 21.3 before 21.3R3-S5, 21.4 before 21.4R3-S5, 22.1 before 22.1R3-S3, 22.2 before 22.2R3-S1/S2, 22.3 before 22.3R2-S2/R3, 22.4 before 22.4R2-S1/R3.
- Fixed
- 20.4R3-S8, 21.2R3-S6, 21.3R3-S5, 21.4R3-S5, 22.1R3-S3, 22.2R3-S2, 22.3R3, 22.4R2-S1, 23.2R1.
Summary
Four J-Web bugs rated medium individually combine into unauthenticated RCE on Juniper SRX firewalls and EX switches. watchTowr published a PoC within a week and exploitation followed.
Root cause
J-Web's PHP stack lets an unauthenticated user set PHP environment variables (such as PHPRC) and upload files through an unauthenticated endpoint. Pointing PHP at an attacker-uploaded ini file that sets auto_prepend_file causes PHP to execute attacker-supplied code.
Impact
Unauthenticated code execution on firewalls and switches with exposed J-Web.
Detection
Look for requests carrying PHPRC or other environment variables and uploads to /webauth_operation.php in J-Web logs. Nuclei templates CVE-2023-36844/36845.
Mitigation
Upgrade, or disable J-Web / restrict it to trusted hosts.