CVE-2023-36846
published 2023-08-17CVE-2023-36846: A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to…
PriorityP186medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
KEVITWEXPLOITInitial access
CISA Known Exploited Vulnerabilitydue 2023-11-17
Exploited in the wild
EPSS
94.21%
99.8th percentile
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of
integrity
for a certain
part of the file system, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on SRX Series:
* All versions prior to 20.4R3-S8;
* 21.1 versions 21.1R1 and later;
* 21.2 versions prior to 21.2R3-S6;
* 21.3 versions
prior to
21.3R3-S5;
* 21.4 versions
prior to
21.4R3-S5;
* 22.1 versions
prior to
22.1R3-S3;
* 22.2 versions
prior to
22.2R3-S2;
* 22.3 versions
prior to
22.3R2-S2, 22.3R3;
* 22.4 versions
prior to
22.4R2-S1, 22.4R3.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | j-web | — | — |
| juniper | junos | < 20.4 | 20.4 |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos_os | — | — |
| juniper | srx_series | — | — |
| juniper_networks | junos_os | < 20.4R3-S8 | 20.4R3-S8 |
| juniper_networks | junos_os | >= 21.1 < 21.1* | 21.1* |
| juniper_networks | junos_os | >= 21.2 < 21.2R3-S6 | 21.2R3-S6 |
| juniper_networks | junos_os | >= 21.3 < 21.3R3-S5 | 21.3R3-S5 |
| juniper_networks | junos_os | >= 21.4 < 21.4R3-S5 | 21.4R3-S5 |
| juniper_networks | junos_os | >= 22.1 < 22.1R3-S3 | 22.1R3-S3 |
| juniper_networks | junos_os | >= 22.2 < 22.2R3-S2 | 22.2R3-S2 |
| juniper_networks | junos_os | >= 22.3 < 22.3R2-S2, 22.3R3 | 22.3R2-S2, 22.3R3 |
| juniper_networks | junos_os | >= 22.4 < 22.4R2-S1, 22.4R3 | 22.4R2-S1, 22.4R3 |
Detection & IOCsextracted from sources · hover to see the quote
path/webauth_operation.php
commandrs=do_upload&rsargs[]=[{"fileData": "data:text/html;base64,<payload>", "fileName": "<rand>.php", "csize": <len>}]
commandrs=do_upload&rsargs[]=[{"fileName": "<rand>.ini", "fileData": "data:text/html;base64,<auto_prepend_file=/var/tmp/<phpfile>>", "csize": "97"}]
commandGET /webauth_operation.php?PHPRC=/var/tmp/<inifile>
othershodan-query: title:"Juniper Web Device Manager"
- →Monitor for unauthenticated POST requests to /webauth_operation.php with the 'rs=do_upload' parameter, which is the file upload vector used in the exploit chain.
- →Detect GET requests to /webauth_operation.php containing the PHPRC query parameter pointing to /var/tmp/, which is used to load a malicious .ini file and trigger PHP code execution.
- →Alert on unauthenticated requests to user.php on Juniper SRX J-Web interfaces, as this endpoint is the specific target for unauthenticated file upload (CVE-2023-36846). ↗
- →The exploit chain requires uploading two files (a .php payload and a .ini config with auto_prepend_file directive) — detecting either upload to /var/tmp/ via J-Web is a strong indicator of compromise. ↗
- →ShadowServer and GreyNoise have observed active probing of Junos OS endpoints; correlate inbound J-Web traffic spikes against these threat intel feeds for early warning. ↗
- ·CVE-2023-36846 alone has a medium CVSS score (5.3) but becomes critical (9.8) when chained with CVE-2023-36844/36845/36847. Detection and patching priority should reflect the chained severity, not the standalone score. ↗
- ·VulnCheck demonstrated that CVE-2023-36845 alone (without CVE-2023-36846 file upload) can achieve RCE via PHPRC/auto_prepend_file/allow_url_include and the data:// protocol, bypassing the need to upload files entirely. ↗
- ·The Nuclei PoC template targets /webauth_operation.php (do_upload function), but older SRX devices (e.g., SRX210) may lack the do_fileUpload() function, meaning the watchTowr chain may not work on all hardware — but the single-CVE VulnCheck method may still apply. ↗
- ·As a temporary mitigation if patching is not immediately possible, restrict J-Web access to trusted network hosts only to eliminate the internet-exposed attack vector. ↗
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vulncheck5.3MEDIUM
cisa5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
cisa·2023-11-13·CVSS 5.3
CVE-2023-36846 [MEDIUM] CWE-306 Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
Vulnerability: Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
Affected: Juniper Junos OS
Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-B
Juniper
CVE-2023-36846: A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attac
vendor_juniper·2023-08-17·CVSS 5.3
CVE-2023-36846 [MEDIUM] CWE-306 CVE-2023-36846: A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attac
CVE-2023-36846: A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of
integrity
for a certain
part of the file system, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on SRX Series:
* All versions prior to 20.4R3-S8;
* 21.1 versions 21.1R1 and later;
* 21.2 versions prior to 21.2R3-S6;
* 21.3 versions
prior to
21.3R3-S5;
* 21.4 versions
prior to
21.4R3-S5;
* 22.1 versions
prior to
22.1R3-S3;
* 22.2 versions
prior to
22.2R3-S2;
GHSA
GHSA-rrhw-mwxf-m9mp: A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attac
ghsa_unreviewed·2023-08-17
CVE-2023-36846 [MEDIUM] CWE-306 GHSA-rrhw-mwxf-m9mp: A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attac
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of
integrity
for a certain
part of the file system, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on SRX Series:
* All versions prior to 20.4R3-S8;
* 21.2 versions prior to 21.2R3-S6;
* 21.3 versions
prior to
21.3R3-S5;
* 21.4 versions
prior to
21.4R3-S5;
* 22.1 versions
prior to
22.1R3-S3;
* 22.2 versions
prior to
22.2R3-S2;
* 22.3 versions
prior to
22.3R2-S2, 22.3R3;
* 22.4 versions
VulnCheck
Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
vulncheck·2023·CVSS 5.3
CVE-2023-36846 [MEDIUM] CWE-306 Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
Juniper Junos OS on SRX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to user.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.
Affected: Juniper Junos OS
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://twitter.com/Shadowserver/status/1696512418036486246; https://su
Suricata
ET EXPLOIT Junos OS - Successful Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)
suricata·2023-09-01·CVSS 5.3
CVE-2023-36846 [MEDIUM] ET EXPLOIT Junos OS - Successful Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)
ET EXPLOIT Junos OS - Successful Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)
Rule: alert http [$HOME_NET,$HTTP_SERVERS] any -> any any (msg:"ET EXPLOIT Junos OS - Successful Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)"; flow:established,to_client; flowbits:isset,ET.CVE-2023-36851; http.stat_code; content:"200"; http.response_body; content:"|22|converted_fileName|22|"; fast_pattern; content:"0|3a 20|"; distance:0; content:"|22|original_fileName|22|"; reference:url,supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution; reference:url,labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/; refer
Suricata
ET EXPLOIT Junos OS - Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)
suricata·2023-09-01·CVSS 5.3
CVE-2023-36846 [MEDIUM] ET EXPLOIT Junos OS - Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)
ET EXPLOIT Junos OS - Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Junos OS - Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)"; flow:established,to_server; flowbits:set,ET.CVE-2023-36851; http.method; content:"POST"; http.uri; content:"/webauth_operation.php"; fast_pattern; http.request_body; content:"rs=do_upload"; nocase; content:"rsargs"; nocase; content:"fileName"; nocase; content:"fileData"; nocase; content:"csize"; nocase; reference:url,supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution; reference:url,labs.watchtowr.com/cve-2023-3
Nuclei
Juniper Devices - Remote Code Execution
nuclei·CVSS 5.3
CVE-2023-36844 [MEDIUM] Juniper Devices - Remote Code Execution
Juniper Devices - Remote Code Execution
Multiple cves in Juniper Network (CVE-2023-36844|CVE-2023-36845|CVE-2023-36846|CVE-2023-36847).A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environments variables. Utilizing a crafted request an attacker is able to modify certain PHP environments variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.
Template:
id: CVE-2023-36844
info:
name: Juniper Devices - Remote Code Execution
author: princechaddha,ritikchaddha
severity: medium
description: |
Multiple cves in Juniper Network (CVE-2023-36844|CVE-2023-36845|CVE-2023-36846|CVE-2023-36847).A PHP External Variable Modifi
Tenable
Verizon 2025 DBIR: Tenable Research Collaboration Shines a Spotlight on CVE Remediation Trends
blogs_tenable·2025-04-23
Verizon 2025 DBIR: Tenable Research Collaboration Shines a Spotlight on CVE Remediation Trends
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
Juniper warns of critical RCE bug in its firewalls and switches
blogs_bleepingcomputer·2024-01-12·CVSS 9.8
CVE-2024-21591 [CRITICAL] Juniper warns of critical RCE bug in its firewalls and switches
## Juniper warns of critical RCE bug in its firewalls and switches
## Sergiu Gatlan
Juniper Networks has released security updates to fix a critical pre-auth remote code execution (RCE) vulnerability in its SRX Series firewalls and EX Series switches.
Found in the devices' J-Web configuration interfaces and tracked as CVE-2024-21591, this critical security flaw can also be exploited by unauthenticated threat actors to get root privileges or launch denial-of-service (DoS) attacks against unpatched devices.
"This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory," the company explained in a security advisory published Wednesday.
At the moment, Juniper's Security Incident Response Team has no evidence that the vulnerability is being exploit
Bleepingcomputer
CISA warns of actively exploited Juniper pre-auth RCE exploit chain
blogs_bleepingcomputer·2023-11-13·CVSS 5.3
CVE-2023-36844 [MEDIUM] CISA warns of actively exploited Juniper pre-auth RCE exploit chain
## CISA warns of actively exploited Juniper pre-auth RCE exploit chain
## Sergiu Gatlan
CISA warned federal agencies today to secure Juniper devices on their networks by Friday against four vulnerabilities now used in remote code execution (RCE) attacks as part of a pre-auth exploit chain.
The alert comes one week after Juniper updated its advisory to notify customers that the flaws found in Juniper's J-Web interface (tracked as CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847) have been successfully exploited in the wild.
"Juniper SIRT is now aware of successful exploitation of these vulnerabilities. Customers are urged to immediately upgrade," the company said .
The warnings come after the ShadowServer threat monitoring service revealed it was already detecting exp
Bleepingcomputer
Thousands of Juniper devices vulnerable to unauthenticated RCE flaw
blogs_bleepingcomputer·2023-09-18·CVSS 5.3
CVE-2023-36844 [MEDIUM] Thousands of Juniper devices vulnerable to unauthenticated RCE flaw
## Thousands of Juniper devices vulnerable to unauthenticated RCE flaw
## Bill Toulas
An estimated 12,000 Juniper SRX firewalls and EX switches are vulnerable to a fileless remote code execution flaw that attackers can exploit without authentication.
In August, Juniper disclosed numerous 'PHP environment variant manipulation' (CVE-2023-36844/CVE-2023-36845) and 'Missing Authentication for Critical Function' (CVE-2023-36846/CVE-2023-36847) vulnerabilities that by themselves only had a 'medium' severity rating of 5.3.
However, when chained together, these vulnerabilities became a critical remote code execution flaw with a rating of 9.8.
In a later technical report , watchTowr Labs released a PoC that chained the CVE-2023-36845 and CVE-2023-36846 flaws, allowing the researchers to remote
Greynoiseio
NoiseLetter March 2026
blogs_greynoiseio
NoiseLetter March 2026
Events, events… and yes, even more events. 🌍 GreyNoise has been on the move. March kept us busy with stops at eCrimes in London and SecIT in Hanover—but we’re just getting started. Over the next few months, we’ll be hitting the road for CrowdStrike CrowdTours across eight cities, heading to Glasgow to speak and sponsor CyberUK, and making our way to Tampa for H-ISAC. If you’ll be at any of these (or nearby), we’d love to connect.
And while we’ve been racking up miles, we haven’t slowed down on the research front. We’ve just released some exciting new findings—with even more coming in the next few weeks—so keep an eye out.
Thanks, as always, for being part of the GreyNoise community.
Featured
About this new report
Every enterprise firewall processes traffic from residential IP space. T
2023-08-17
Published
2023-11-13
Added to CISA KEV
Exploited in the wild