erroneo.us
Search all guides⌘K

Digest · Thursday

Security digest: August 17, 2023

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: Junos J-Web CVE-2023-36845 Chain: Pre-Auth RCE on SRX/EX. Owners of Juniper SRX firewalls and EX switches on Junos builds older than the fixed releases with J-Web (HTTP/HTTPS web management) reachable from untrusted networks.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2023-36844, CVE-2023-36845

Junos J-Web CVE-2023-36845 Chain: Pre-Auth RCE on SRX/EX

Patched since 2023 and only reachable through J-Web; confirm no SRX or EX device runs an old Junos build with J-Web exposed, and hunt on any that did in late 2023.

Must act: Owners of Juniper SRX firewalls and EX switches on Junos builds older than the fixed releases with J-Web (HTTP/HTTPS web management) reachable from untrusted networks.

Can relax: Sites whose SRX and EX devices run current Junos releases, or that have J-Web disabled or limited to a management network; other Juniper platforms are not in scope.

  1. Run show version on every SRX and EX device and compare against the fixed releases; move to a current supported Junos release.
  2. Check show configuration system services web-management; if J-Web is not needed, remove it and commit.
  3. If J-Web is needed, limit it to a management interface or trusted hosts, never the public internet.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.