CVE-2023-36847
published 2023-08-17CVE-2023-36847: A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to…
PriorityP188medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
KEVITWEXPLOITRansomwareInitial access
CISA Known Exploited Vulnerabilitydue 2023-11-17
Exploited in the wild
EPSS
84.69%
99.7th percentile
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of
integrity
for a certain
part of the file system, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on EX Series:
* All versions prior to 20.4R3-S8;
* 21.1 versions 21.1R1 and later;
* 21.2 versions prior to 21.2R3-S6;
* 21.3 versions
prior to
21.3R3-S5;
* 21.4 versions
prior to
21.4R3-S4;
* 22.1 versions
prior to
22.1R3-S3;
* 22.2 versions
prior to
22.2R3-S1;
* 22.3 versions
prior to
22.3R2-S2, 22.3R3;
* 22.4 versions
prior to
22.4R2-S1, 22.4R3.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| juniper | ex_series | — | — |
| juniper | j-web | — | — |
| juniper | junos | < 20.4 | 20.4 |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos | — | — |
| juniper | junos_os | — | — |
| juniper_networks | junos_os | < 20.4R3-S8 | 20.4R3-S8 |
| juniper_networks | junos_os | >= 21.1 < 21.1* | 21.1* |
| juniper_networks | junos_os | >= 21.2 < 21.2R3-S6 | 21.2R3-S6 |
| juniper_networks | junos_os | >= 21.3 < 21.3R3-S5 | 21.3R3-S5 |
| juniper_networks | junos_os | >= 21.4 < 21.4R3-S4 | 21.4R3-S4 |
| juniper_networks | junos_os | >= 22.1 < 22.1R3-S3 | 22.1R3-S3 |
| juniper_networks | junos_os | >= 22.2 < 22.2R3-S1 | 22.2R3-S1 |
| juniper_networks | junos_os | >= 22.3 < 22.3R2-S2, 22.3R3 | 22.3R2-S2, 22.3R3 |
| juniper_networks | junos_os | >= 22.4 < 22.4R2-S1, 22.4R3 | 22.4R2-S1, 22.4R3 |
Detection & IOCsextracted from sources · hover to see the quote
commandrs=do_upload&rsargs[]=[{"fileData": "data:text/html;base64,...", "fileName": "<rand>.php", "csize": ...}]↗
- →Monitor for unauthenticated POST requests to /webauth_operation.php with 'rs=do_upload' parameter, which indicates exploitation of the file upload chain (CVE-2023-36846/36847). ↗
- →Detect GET requests to /webauth_operation.php with a PHPRC query parameter pointing to /var/tmp/, indicating PHPRC environment variable manipulation for RCE. ↗
- →Monitor for unauthenticated POST requests to /installAppPackage.php, the specific endpoint targeted by CVE-2023-36847 for arbitrary file upload. ↗
- →Use Shodan query 'title:"Juniper Web Device Manager"' to identify internet-exposed J-Web interfaces that may be vulnerable. ↗
- →Look for .php and .ini file uploads to /var/tmp/ via J-Web as part of the two-file exploit chain (watchTowr PoC), where the .ini file sets auto_prepend_file. ↗
- →ShadowServer and GreyNoise have observed active probing of Junos OS endpoints; correlate inbound J-Web traffic against threat intel feeds from these sources. ↗
- ·CVE-2023-36847 alone causes limited file system integrity impact; critical RCE is only achieved when chained with CVE-2023-36844/36845/36846. Detection should account for the full chain. ↗
- ·VulnCheck demonstrated a single-CVE (CVE-2023-36845) RCE path using only environment variable manipulation and the data:// protocol, bypassing the need to upload files — meaning file-upload-based detections alone are insufficient. ↗
- ·Older Juniper SRX devices (e.g., SRX210) may lack the do_fileUpload() function, meaning the watchTowr two-file exploit chain may not work on them, but the single-curl VulnCheck exploit may still apply. ↗
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
vulncheck5.3MEDIUM
cisa5.3MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
cisa·2023-11-13·CVSS 5.3
CVE-2023-36847 [MEDIUM] CWE-306 Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
Vulnerability: Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
Affected: Juniper Junos OS
Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle
Juniper
CVE-2023-36847: A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attack
vendor_juniper·2023-08-17·CVSS 5.3
CVE-2023-36847 [MEDIUM] CWE-306 CVE-2023-36847: A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attack
CVE-2023-36847: A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request to installAppPackage.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of
integrity
for a certain
part of the file system, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on EX Series:
* All versions prior to 20.4R3-S8;
* 21.1 versions 21.1R1 and later;
* 21.2 versions prior to 21.2R3-S6;
* 21.3 versions
prior to
21.3R3-S5;
* 21.4 versions
prior to
21.4R3-S4;
* 22.1 versions
prior to
22.1R3-S3;
* 22.2 versions
prior to
GHSA
GHSA-c38p-r7xc-grgp: A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attack
ghsa_unreviewed·2023-08-17
CVE-2023-36847 [MEDIUM] CWE-306 GHSA-c38p-r7xc-grgp: A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attack
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of
integrity
for a certain
part of the file system, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on EX Series:
* All versions prior to 20.4R3-S8;
* 21.2 versions prior to 21.2R3-S6;
* 21.3 versions
prior to
21.3R3-S5;
* 21.4 versions
prior to
21.4R3-S4;
* 22.1 versions
prior to
22.1R3-S3;
* 22.2 versions
prior to
22.2R3-S1;
* 22.3 versions
prior to
22.3R2-S2, 22.3R3;
* 22.4 versions
p
VulnCheck
Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
vulncheck·2023·CVSS 5.3
CVE-2023-36847 [MEDIUM] CWE-306 Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
Juniper Junos OS on EX Series contains a missing authentication for critical function vulnerability that allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to installAppPackage.php that doesn't require authentication, an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.
Affected: Juniper Junos OS
Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Known Ransomware Campaign Use: Known
Exploitation References: https://twitter.com/Sh
Suricata
ET EXPLOIT Junos OS - Successful Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)
suricata·2023-09-01·CVSS 5.3
CVE-2023-36846 [MEDIUM] ET EXPLOIT Junos OS - Successful Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)
ET EXPLOIT Junos OS - Successful Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)
Rule: alert http [$HOME_NET,$HTTP_SERVERS] any -> any any (msg:"ET EXPLOIT Junos OS - Successful Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)"; flow:established,to_client; flowbits:isset,ET.CVE-2023-36851; http.stat_code; content:"200"; http.response_body; content:"|22|converted_fileName|22|"; fast_pattern; content:"0|3a 20|"; distance:0; content:"|22|original_fileName|22|"; reference:url,supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution; reference:url,labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/; refer
Suricata
ET EXPLOIT Junos OS - Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)
suricata·2023-09-01·CVSS 5.3
CVE-2023-36846 [MEDIUM] ET EXPLOIT Junos OS - Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)
ET EXPLOIT Junos OS - Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)
Rule: alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Junos OS - Unauthenticated Arbitrary File Upload Attempt (CVE-2023-36851)"; flow:established,to_server; flowbits:set,ET.CVE-2023-36851; http.method; content:"POST"; http.uri; content:"/webauth_operation.php"; fast_pattern; http.request_body; content:"rs=do_upload"; nocase; content:"rsargs"; nocase; content:"fileName"; nocase; content:"fileData"; nocase; content:"csize"; nocase; reference:url,supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution; reference:url,labs.watchtowr.com/cve-2023-3
Nuclei
Juniper Devices - Remote Code Execution
nuclei·CVSS 5.3
CVE-2023-36844 [MEDIUM] Juniper Devices - Remote Code Execution
Juniper Devices - Remote Code Execution
Multiple cves in Juniper Network (CVE-2023-36844|CVE-2023-36845|CVE-2023-36846|CVE-2023-36847).A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environments variables. Utilizing a crafted request an attacker is able to modify certain PHP environments variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.
Template:
id: CVE-2023-36844
info:
name: Juniper Devices - Remote Code Execution
author: princechaddha,ritikchaddha
severity: medium
description: |
Multiple cves in Juniper Network (CVE-2023-36844|CVE-2023-36845|CVE-2023-36846|CVE-2023-36847).A PHP External Variable Modifi
Tenable
Verizon 2025 DBIR: Tenable Research Collaboration Shines a Spotlight on CVE Remediation Trends
blogs_tenable·2025-04-23
Verizon 2025 DBIR: Tenable Research Collaboration Shines a Spotlight on CVE Remediation Trends
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
Juniper warns of critical RCE bug in its firewalls and switches
blogs_bleepingcomputer·2024-01-12·CVSS 9.8
CVE-2024-21591 [CRITICAL] Juniper warns of critical RCE bug in its firewalls and switches
## Juniper warns of critical RCE bug in its firewalls and switches
## Sergiu Gatlan
Juniper Networks has released security updates to fix a critical pre-auth remote code execution (RCE) vulnerability in its SRX Series firewalls and EX Series switches.
Found in the devices' J-Web configuration interfaces and tracked as CVE-2024-21591, this critical security flaw can also be exploited by unauthenticated threat actors to get root privileges or launch denial-of-service (DoS) attacks against unpatched devices.
"This issue is caused by use of an insecure function allowing an attacker to overwrite arbitrary memory," the company explained in a security advisory published Wednesday.
At the moment, Juniper's Security Incident Response Team has no evidence that the vulnerability is being exploit
Bleepingcomputer
CISA warns of actively exploited Juniper pre-auth RCE exploit chain
blogs_bleepingcomputer·2023-11-13·CVSS 5.3
CVE-2023-36844 [MEDIUM] CISA warns of actively exploited Juniper pre-auth RCE exploit chain
## CISA warns of actively exploited Juniper pre-auth RCE exploit chain
## Sergiu Gatlan
CISA warned federal agencies today to secure Juniper devices on their networks by Friday against four vulnerabilities now used in remote code execution (RCE) attacks as part of a pre-auth exploit chain.
The alert comes one week after Juniper updated its advisory to notify customers that the flaws found in Juniper's J-Web interface (tracked as CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847) have been successfully exploited in the wild.
"Juniper SIRT is now aware of successful exploitation of these vulnerabilities. Customers are urged to immediately upgrade," the company said .
The warnings come after the ShadowServer threat monitoring service revealed it was already detecting exp
Bleepingcomputer
Thousands of Juniper devices vulnerable to unauthenticated RCE flaw
blogs_bleepingcomputer·2023-09-18·CVSS 5.3
CVE-2023-36844 [MEDIUM] Thousands of Juniper devices vulnerable to unauthenticated RCE flaw
## Thousands of Juniper devices vulnerable to unauthenticated RCE flaw
## Bill Toulas
An estimated 12,000 Juniper SRX firewalls and EX switches are vulnerable to a fileless remote code execution flaw that attackers can exploit without authentication.
In August, Juniper disclosed numerous 'PHP environment variant manipulation' (CVE-2023-36844/CVE-2023-36845) and 'Missing Authentication for Critical Function' (CVE-2023-36846/CVE-2023-36847) vulnerabilities that by themselves only had a 'medium' severity rating of 5.3.
However, when chained together, these vulnerabilities became a critical remote code execution flaw with a rating of 9.8.
In a later technical report , watchTowr Labs released a PoC that chained the CVE-2023-36845 and CVE-2023-36846 flaws, allowing the researchers to remote
Checkpoint
4th September – Threat Intelligence Report
blogs_checkpoint·2023-09-04
CVE-2023-36844 4th September – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 4th September – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 4th September, please download our Threat_Intelligence Bulletin
TOP ATTACKS AND BREACHES
The FBI announced operation ‘Duck Hunt’ dismantling the Qakbot (Qbot) malware operation that is active since at least 2008. Qakbot has been known to infect victims via spam emails with malicious attachments and links, while also serving as a platform for ransomware operators. It has impacted over 700,000 computers worldwi
Checkpoint
28th August – Threat Intelligence Report
blogs_checkpoint·2023-08-28
CVE-2023-38035 28th August – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 28th August – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 28th August, please download our Threat_Intelligence Bulletin
TOP ATTACKS AND BREACHES
An ongoing espionage campaign targeting dozens of organizations in Taiwan has been discovered. Researchers have attributed the activity to a Chinese APT group dubbed Flax Typhoon, which overlaps with Ethereal Panda. The threat group minimizes the use of custom malware, and instead uses legitimate tools found in victims’ opera
2023-08-17
Published
2023-11-13
Added to CISA KEV
Exploited in the wild