CVE-2023-36844

What it actually does

The flaw is an unauthenticated, network-reachable input-validation issue in Juniper J-Web on affected Junos OS EX Series switches. A crafted HTTP request can alter important PHP environment variables used by the J-Web application. By itself, the direct impact is partial loss of application integrity, but in practice this class of issue is especially dangerous because PHP environment manipulation can be chained with file upload, local file inclusion, configuration injection, or other J-Web weaknesses to influence PHP execution behavior and potentially support command execution or persistent webshell deployment.

Why it matters to the business

Because J-Web is a management interface on network switching infrastructure, successful exploitation can undermine trust in the device management plane. If chained with related vulnerabilities, an attacker may gain control over switches, alter configurations, disrupt network availability, capture traffic metadata, pivot further into the environment, or maintain persistence on critical infrastructure. This vulnerability is listed in CISA KEV with a remediation deadline of 2023-11-17, has active in-the-wild exploitation, and has a high EPSS likelihood, so internet- or broadly reachable J-Web services should be treated as urgent exposure even though the standalone CVSS score is moderate.

How an attack unfolds

An attacker first identifies an affected Juniper EX Series switch with J-Web reachable over HTTP or HTTPS. The attacker then sends a crafted unauthenticated request containing parameters or headers intended to modify PHP runtime/environment variables used by the J-Web process. Those variables can change how PHP loads configuration, includes files, or interprets request content. In common real-world attack patterns, this type of primitive is not used alone; it is combined with another J-Web weakness that allows file placement, path manipulation, or request smuggling into PHP execution paths. The combined chain can let the attacker cause J-Web to process attacker-controlled PHP directives or content, resulting in unauthorized changes, command execution, or placement of a webshell. After exploitation, the attacker may run commands under the web service context, collect device information, change configuration, create persistence, or use the switch as a staging point for lateral movement.

How to fix it

Upgrade affected Juniper Networks Junos OS EX Series devices to a fixed release. Fixed trains identified by Juniper include: 20.4R3-S9 or later; 21.2R3-S7 or later; 21.3R3-S5 or later; 21.4R3-S5 or later; 22.1R3-S4 or later; 22.2R3-S2 or later; 22.3R3-S1 or later; 22.4R2-S2, 22.4R3, or later; and 23.2R1-S1, 23.2R2, or later. The 21.1 train is affected from 21.1R1 onward and should be moved to a fixed supported train. As an immediate mitigation, disable J-Web if it is not required, restrict J-Web access to a dedicated management network or VPN, block access from the internet and untrusted networks, and enforce ACLs/firewall rules around TCP/80 and TCP/443 on management interfaces. Because exploitation is known in the wild and the issue is commonly chainable, remediation should include both patching and post-remediation compromise assessment.

How to confirm the fix worked

Confirm the installed Junos OS version on each EX Series device and verify it is at or above the applicable fixed release for its train. Validate that J-Web is disabled where not required or reachable only from approved management sources. From an untrusted network segment, confirm that HTTP/HTTPS access to the J-Web interface is blocked. Review configuration and management-plane ACLs to ensure only authorized administrative networks can connect. After upgrading, retest with a safe scanner or vendor-supported vulnerability check that identifies the fixed Junos release rather than attempting exploit payloads. Also verify that no unexpected PHP files, temporary files, unauthorized users, or suspicious configuration changes remain from pre-patch exposure.

Typical attack path

1. Scan for Juniper EX Series devices exposing the J-Web management interface over HTTP or HTTPS.
2. Fingerprint Junos/J-Web version or infer vulnerability from response behavior.
3. Send unauthenticated crafted HTTP requests that attempt to set PHP-related environment variables such as PHP configuration paths or include directives.
4. Chain the environment-variable manipulation with another weakness that allows attacker-controlled PHP configuration or content to be processed.
5. Execute commands, modify device state, or deploy a temporary or persistent webshell if the chain succeeds.
6. Collect configuration, credentials, routing/switching information, or use the compromised device for further internal reconnaissance and pivoting.
7. Attempt to remove logs, blend into normal management traffic, or maintain access through configuration changes or dropped files.

How to detect it

Review J-Web/httpd access logs, system messages, authentication logs, configuration change logs, and file-system artifacts for signs of unauthenticated requests attempting to manipulate PHP runtime variables. Useful log sources include J-Web HTTP access/error logs, Junos system logs, command/accounting logs, configuration commit history, and network telemetry for management-plane traffic. Look for requests to the J-Web service containing PHP environment/configuration terms such as PHPRC, PHP_INI_SCAN_DIR, PHP_VALUE, PHP_ADMIN_VALUE, auto_prepend_file, allow_url_include, open_basedir, php://input, or data://. Investigate unexpected HTTP POST requests from unknown sources, requests with unusually long query strings, URL-encoded PHP directives, or requests immediately followed by new files in temporary or web-accessible directories. Because this issue is often chained, also hunt for evidence of webshells, suspicious PHP files, commands executed by the web process, abnormal outbound connections from the switch, unauthorized configuration commits, new local users, modified SSH keys, or unexplained reboots. Correlate management-interface access from external IPs with any subsequent configuration or file-system changes.

• PHPRC=
• PHP_INI_SCAN_DIR=
• PHP_VALUE=
• PHP_ADMIN_VALUE=
• auto_prepend_file
• allow_url_include
• open_basedir
• php://input
• data://text/plain
• /var/log/httpd.log
• /var/log/messages
• /var/tmp/
• /tmp/
• /cf/var/tmp/
• /jweb/
• POST /
• GET /?PHPRC=

What your security team should do

• Immediately inventory Juniper EX Series switches and identify any device running an affected Junos OS release with J-Web enabled.
• Prioritize internet-facing or broadly reachable J-Web interfaces for emergency mitigation: disable J-Web or restrict access before scheduling upgrades.
• Upgrade to the applicable fixed Junos OS release: 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S2, 22.3R3-S1, 22.4R2-S2/22.4R3, 23.2R1-S1/23.2R2, or later as appropriate.
• Treat devices exposed before patching as potentially compromised and perform log review, file-system review, and configuration integrity checks.
• Search historical web-management logs for PHP environment variable manipulation attempts and suspicious requests involving PHPRC, PHP_VALUE, PHP_INI_SCAN_DIR, auto_prepend_file, php://input, or data:// payloads.
• Review device configuration for unauthorized local users, SSH keys, altered management services, changed SNMP/community settings, modified event scripts, or unexpected outbound connectivity.
• Monitor for follow-on activity from affected switch management IPs, including unusual DNS, HTTP/S, SSH, SCP, FTP, TFTP, or connections to unfamiliar external hosts.
• Place J-Web behind a management VPN or bastion and enforce source-IP restrictions as a permanent control.