cbcvebase.
CVE-2023-36844
published 2023-08-17

CVE-2023-36844: A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to…

PriorityP189medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2023-11-17
Exploited in the wild
EPSS
90.97%
99.8th percentile
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environment variables. Using a crafted request an attacker is able to modify certain PHP environment variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on EX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R3-S1; * 22.4 versions prior to 22.4R2-S2, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.

Affected

24 ranges
VendorProductVersion rangeFixed in
juniperex_series
juniperj-web
juniperjunos< 20.420.4
juniperjunos
juniperjunos
juniperjunos
juniperjunos
juniperjunos
juniperjunos
juniperjunos
juniperjunos
juniperjunos
juniperjunos
juniperjunos_os
juniper_networksjunos_os< 20.4R3-S920.4R3-S9
juniper_networksjunos_os>= 21.1 < 21.1*21.1*
juniper_networksjunos_os>= 21.2 < 21.2R3-S621.2R3-S6
juniper_networksjunos_os>= 21.3 < 21.3R3-S521.3R3-S5
juniper_networksjunos_os>= 21.4 < 21.4R3-S521.4R3-S5
juniper_networksjunos_os>= 22.1 < 22.1R3-S422.1R3-S4
juniper_networksjunos_os>= 22.2 < 22.2R3-S222.2R3-S2
juniper_networksjunos_os>= 22.3 < 22.3R3-S122.3R3-S1
juniper_networksjunos_os>= 22.4 < 22.4R2-S2, 22.4R322.4R2-S2, 22.4R3
juniper_networksjunos_os>= 23.2 < 23.2R1-S1, 23.2R223.2R1-S1, 23.2R2

Detection & IOCsextracted from sources · hover to see the quote

url/webauth_operation.php
path/webauth_operation.php
commandrs=do_upload&rsargs[]=[{"fileData": "data:text/html;base64,...", "fileName": "*.php", ...}]
commandPHPRC=/var/tmp/<inifile>
path/dev/fd/0
otherauto_prepend_file (PHP ini directive used in exploit)
otherallow_url_include (PHP ini directive used in exploit)
othershodan-query: title:"Juniper Web Device Manager"
  • Monitor for POST requests to /webauth_operation.php with parameters 'rs=do_upload' and 'rsargs[]' containing base64-encoded payloads or .php/.ini file uploads — this is the primary attack vector for the exploit chain.
  • Detect GET requests to /webauth_operation.php with a PHPRC query parameter pointing to /var/tmp/, indicating PHP environment variable manipulation for RCE.
  • Alert on HTTP requests to J-Web (webauth_operation.php) that include 'auto_prepend_file' or 'allow_url_include' in POST body or query string, as these are used to achieve fileless RCE via the data:// protocol.
  • Watch for references to /dev/fd/0 in HTTP requests targeting Juniper J-Web, which is used to read stdin as a pseudo-file for fileless code execution.
  • Use Shodan query 'title:"Juniper Web Device Manager"' to identify internet-exposed Juniper J-Web interfaces for asset discovery and exposure assessment.
  • ·CVE-2023-36844 alone is rated 'medium' (CVSS 5.3), but when chained with CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847, the combined exploit achieves critical unauthenticated RCE (CVSS 9.8). Detection and patching priority should reflect the chained severity, not the individual score.
  • ·VulnCheck demonstrated a single-CVE (CVE-2023-36845 only) fileless RCE variant using a single curl command, bypassing the need to upload files — detection rules requiring file upload activity may miss this newer variant.
  • ·The original watchTowr PoC required uploading two files (a .php and a .ini), but the VulnCheck variant achieves RCE without any file uploads using the data:// protocol — both attack patterns must be covered in detection logic.
  • ·Older Juniper SRX devices (e.g., SRX210) may lack the do_fileUpload() function, meaning the watchTowr file-upload exploit chain will not work on them, but the VulnCheck fileless variant may still apply.

CVSS provenance

nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vulncheck5.3MEDIUM
cisa5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.