Vulnerability Details : CVE-2023-36845

Public exploit exists!
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code. This issue affects Juniper Networks Junos OS on EX Series and SRX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.
Published 2023-08-17 20:15:10
Updated 2025-02-13 17:16:44
Source Juniper Networks, Inc.
View at NVD,   CVE.org
Vulnerability category: Execute code

Products affected by CVE-2023-36845

CVE-2023-36845 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:
Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
CISA required action:
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA description:
Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP
Notes:
https://supportportal.juniper.net/s/article/2023-08-Out-of-Cycle-Security-Bulletin-Junos-OS-SRX-Series-and-EX-Series-Multiple-vulnerabilities-in-J-Web-can-be-combined-to-allow-a-preAuth-Remote-Code-Execution?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2023-36845
Added on 2023-11-13 Action due date 2023-11-17

Exploit prediction scoring system (EPSS) score for CVE-2023-36845

EPSS FAQ
94.36%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2023-36845

  • Junos OS PHPRC Environment Variable Manipulation RCE
    Disclosure Date: 2023-08-17
    First seen: 2023-10-08
    exploit/freebsd/http/junos_phprc_auto_prepend_file
    This module exploits a PHP environment variable manipulation vulnerability affecting Juniper SRX firewalls and EX switches. The affected Juniper devices run FreeBSD and every FreeBSD process can access their stdin by opening /dev/fd/0. The exploit also makes use of two

CVSS scores for CVE-2023-36845

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
9.8
 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
3.9
5.9
 Juniper Networks, Inc.

CWE ids for CVE-2023-36845

  • A PHP application does not properly protect against the modification of variables from external sources, such as query parameters or cookies. This can expose the application to numerous weaknesses that would not exist otherwise.
    Assigned by: sirt@juniper.net (Secondary)

References for CVE-2023-36845

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close