erroneo.us
Search all guides⌘K

Security Digest · Aug 17, 2023 · Vulnerability · Network edge

Junos J-Web CVE-2023-36845 Chain: Pre-Auth RCE on SRX/EX

Five J-Web bugs in Junos OS on SRX firewalls and EX switches allow unauthenticated RCE; exploited since 2023. Patch, and keep J-Web off the internet.

Published By erroneo.us Security Desk · Updated 3 min read8 sources

Our verdict

Check exposure

Patched since 2023 and only reachable through J-Web; confirm no SRX or EX device runs an old Junos build with J-Web exposed, and hunt on any that did in late 2023.

Who must act: Owners of Juniper SRX firewalls and EX switches on Junos builds older than the fixed releases with J-Web (HTTP/HTTPS web management) reachable from untrusted networks.

Who can relax: Sites whose SRX and EX devices run current Junos releases, or that have J-Web disabled or limited to a management network; other Juniper platforms are not in scope.

Affected
Junos OS on EX and SRX Series: all versions before 20.4R3-S9, all 21.1, 21.2 before 21.2R3-S7, 21.3 before 21.3R3-S5, 21.4 before 21.4R3-S5, 22.1 before 22.1R3-S4, 22.2 before 22.2R3-S2, 22.3 before 22.3R2-S2/22.3R3-S1, 22.4 before 22.4R2-S1/22.4R3, 23.2 before 23.2R1-S1/23.2R2 (CVE-2023-36845)
SRX Series only, CVE-2023-36851: 21.2 before 21.2R3-S8, 21.4 before 21.4R3-S6, 22.1 before 22.1R3-S5, 22.2 before 22.2R3-S3, 22.3 before 22.3R3-S2, 22.4 before 22.4R2-S2/22.4R3, 23.2 before 23.2R1-S2/23.2R2
Fixed in
CVE-2023-36845: 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S2, 22.3R2-S2, 22.3R3-S1, 22.4R2-S1, 22.4R3, 23.2R1-S1, 23.2R2, 23.4R1 and later
CVE-2023-36851: 21.2R3-S8, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R2-S2, 22.4R3, 23.2R1-S2, 23.2R2, 23.4R1 and later
No fix listed for the 21.1 train
CVSS
9.8 (v3.1, CNA)
EPSS
95.1% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Run show version on every SRX and EX device and compare against the fixed releases; move to a current supported Junos release.
  2. Check show configuration system services web-management; if J-Web is not needed, remove it and commit.
  3. If J-Web is needed, limit it to a management interface or trusted hosts, never the public internet.
  4. If a device had J-Web exposed on an unpatched build after August 25, 2023, run the hunt below before trusting it.
  5. On signs of compromise, treat the device configuration and credentials as exposed: reinstall Junos, rotate local, RADIUS/TACACS+ and VPN secrets, and review policy changes.

How to check if you are affected or compromised

  • Look for requests containing PHPRC, such as /?PHPRC=/dev/fd/0, in J-Web HTTP logs; VulnCheck notes the value can also hide in multipart form data.
  • Check /var/jail/sess/php.log for unauthenticated-access errors that watchTowr flags as possible attack attempts.
  • List /var/tmp (/var/jail/tmp inside the J-Web jail) for unexpected .php or php.ini files.
  • Review proxy or firewall logs for POSTs to /webauth_operation.php from outside the management network.

What happened#

On August 17, 2023, Juniper published four CVEs in J-Web, the web management interface of Junos OS on SRX firewalls and EX switches. CVE-2023-36844 and CVE-2023-36845 let an unauthenticated attacker set PHP environment variables. CVE-2023-36846 and CVE-2023-36847 let one upload files without authentication. Juniper's CVE records score four of the five at CVSS 3.1 5.3. The exception is CVE-2023-36845, now scored 9.8 and described as unauthenticated remote code execution. A fifth bug, CVE-2023-36851, published September 26, covers an unauthenticated upload and download through webauth_operation.php on SRX.

On August 25, watchTowr Labs published a chain and proof of concept. It uploads a PHP payload and a php.ini to /var/tmp, then sets PHPRC to that file so auto_prepend_file runs the payload. Shadowserver saw exploitation attempts start that day and counted over 8,200 exposed J-Web interfaces, according to Help Net Security. On September 18, VulnCheck showed that CVE-2023-36845 alone is enough. Setting PHPRC=/dev/fd/0 makes PHP read its config from the request body, so no upload is needed. In a sample of 3,000 exposed devices, 79% were unpatched.

In November 2023, Juniper said its incident response team was "aware of successful exploitation of these vulnerabilities", per Help Net Security. CISA added all five CVEs to the KEV catalog on November 13 with a four-day deadline. Who exploited them and what they deployed has not been disclosed as of Oct 23, 2026.

Who is affected#

Junos OS on EX and SRX Series with J-Web enabled, on builds before the fixed releases listed above. The 21.1 train has no listed fix. The upload bugs split by platform: CVE-2023-36846 and CVE-2023-36851 are SRX-only, CVE-2023-36847 is EX-only. Juniper's workaround is to disable J-Web or limit it to trusted hosts.

Do you really need to act?#

Only if J-Web is reachable. These bugs live entirely in the web UI, so a device managed by CLI, NETCONF or a controller, with J-Web off, is not exposed. For a device that had J-Web on the internet on an old build in late 2023, the risk is real. The exploit is one unauthenticated request, it has been public since August 2023, and Juniper confirmed successful attacks. Patching later does not remove changes an attacker made to the configuration or saved credentials. Most fleets are long past these builds, so the verdict is to check exposure. Note that UNC3886's 2025 Junos router campaign (CVE-2025-21590) is a separate issue.

What to do now#

  1. Run show version on each SRX and EX device and upgrade anything below the fixed releases to a current supported Junos release.
  2. Run show configuration system services web-management. If J-Web is not needed, delete system services web-management and commit.
  3. If it is needed, bind it to a management interface and allow only trusted source addresses.
  4. If a device had J-Web exposed on an unpatched build after August 25, 2023, run the checks below.
  5. On any sign of compromise, reinstall Junos and rotate local, RADIUS/TACACS+ and VPN secrets.

How to tell if you were hit#

  • Search J-Web HTTP logs for PHPRC, for example /?PHPRC=/dev/fd/0. VulnCheck warns the value can sit in multipart form data, which leaves logs largely unhelpful.
  • Check /var/jail/sess/php.log for "Trying to access array offset on value of type null" from session.php and "CACHING FLOW: query user not set". watchTowr says these suggest unauthenticated attempts, not proof of success.
  • Run file list /var/tmp/ and look for unexpected .php or php.ini files.
  • Review perimeter logs for outside POSTs to /webauth_operation.php.

Timeline#

  • — Juniper publishes CVE-2023-36844 through CVE-2023-36847.
  • — watchTowr publishes the chain; exploitation attempts begin.
  • — VulnCheck shows single-bug RCE.
  • — CVE-2023-36851 published.
  • — CISA adds all five CVEs to KEV.

Vulnerability records

  • CVE-2023-36844 · KEV 2023-11-13 · A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to…
  • CVE-2023-36845 · KEV 2023-11-13 · A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based…
  • CVE-2023-36846 · KEV 2023-11-13 · A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to…
  • CVE-2023-36847 · KEV 2023-11-13 · A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to…
  • CVE-2023-36851 · KEV 2023-11-13 · A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. CVE record — CVE-2023-36845 (Juniper) cve.org
  2. CVE record — CVE-2023-36851 (Juniper) cve.org
  3. CVE record — CVE-2023-36846 (Juniper) cve.org
  4. CISA — Known Exploited Vulnerabilities: CVE-2023-36845 cisa.gov
  5. watchTowr Labs — CVE-2023-36844 And Friends: RCE In Juniper Devices labs.watchtowr.com
  6. VulnCheck — Fileless Remote Code Execution on Juniper Firewalls vulncheck.com

Coverage and analysis

  1. Help Net Security — PoC for no-auth RCE on Juniper firewalls released helpnetsecurity.com
  2. Help Net Security — Juniper networking devices under attack helpnetsecurity.com