CVE-2023-36845

What it actually does

CVE-2023-36845 is an unauthenticated remote code execution vulnerability in the J-Web management interface on Juniper Networks Junos OS for EX Series switches and SRX Series firewalls. A crafted HTTP request can set or influence the PHP PHPRC variable, altering the PHP runtime configuration used by J-Web. By controlling PHP configuration behavior, an attacker can inject and execute arbitrary PHP code in the context of the J-Web web service. Because the flaw is network-exploitable, requires no credentials, and needs no user interaction, exposed management interfaces are high-risk targets. Successful exploitation can allow command execution, device configuration changes, credential theft, persistence, traffic interception, or disruption of routing/security functions.

Why it matters to the business

Compromise of an EX switch or SRX firewall can affect both security controls and core network availability. An attacker may gain control of perimeter or internal network infrastructure, alter firewall or routing policies, capture credentials or traffic metadata, disable protections, pivot into protected networks, or cause outages. This vulnerability is listed in CISA KEV with a remediation due date of 2023-11-17 and has a very high EPSS score, indicating strong real-world exploitation likelihood. Although it is not specifically marked as ransomware-used in KEV, compromised network edge devices are commonly used for initial access, persistence, and lateral movement.

How an attack unfolds

An attacker first identifies an internet-facing or otherwise reachable Juniper EX or SRX device with J-Web enabled. They send a crafted HTTP request to the J-Web service that manipulates the PHP execution environment by setting PHPRC or related PHP configuration values. If the device runs an affected Junos OS release, PHP processes the attacker-controlled configuration and executes injected code. The attacker can then run commands under the web service context, inspect or modify device configuration, create persistence, retrieve credentials or session material, deploy tooling, or use the compromised device as a foothold for internal reconnaissance and pivoting. Exploitation has been observed in the wild, so exposed J-Web interfaces should be treated as likely targets even if no compromise is immediately apparent.

How to fix it

Upgrade affected Juniper Junos OS EX Series and SRX Series devices to a fixed release. Fixed or non-affected targets include: 20.4R3-S9 or later for 20.4; 21.2R3-S7 or later for 21.2; 21.3R3-S5 or later for 21.3; 21.4R3-S5 or later for 21.4; 22.1R3-S4 or later for 22.1; 22.2R3-S2 or later for 22.2; 22.3R2-S2, 22.3R3-S1, or later for 22.3; 22.4R2-S1, 22.4R3, or later for 22.4; and 23.2R1-S1, 23.2R2, or later for 23.2. All versions prior to 20.4R3-S9 and 21.1 versions 21.1R1 and later are affected and should be moved to a supported fixed train. If immediate upgrade is not possible, disable J-Web, restrict management access to trusted administrative networks or VPN-only paths, block untrusted access to HTTP/HTTPS management ports, and monitor for exploit attempts. After remediation, rotate administrative credentials and review device configuration for unauthorized changes if the interface was exposed.

How to confirm the fix worked

Confirm the installed Junos OS release on each EX and SRX device and compare it against the fixed release list. Verify that J-Web is disabled where not required, or reachable only from approved management networks. From an external vantage point, confirm that TCP/80 and TCP/443 for device management are not exposed to untrusted networks unless explicitly required. Review configuration and package inventory to ensure devices are no longer on affected trains. Validate that exploit-style requests containing PHPRC or PHP configuration manipulation are blocked or no longer result in PHP/runtime behavior changes. Where possible, perform authenticated configuration review and compare current device configuration against a known-good baseline.

Typical attack path

1. Scan for Juniper EX Series or SRX Series devices with J-Web management reachable over HTTP or HTTPS.
2. Fingerprint the Junos OS/J-Web version or attempt a safe probe to determine whether the target is likely vulnerable.
3. Send a crafted unauthenticated HTTP request that sets or abuses the PHP PHPRC variable or PHP runtime configuration behavior.
4. Cause J-Web/PHP to load attacker-controlled PHP configuration or code.
5. Execute commands on the device in the context of the J-Web web service.
6. Collect device configuration, credentials, session tokens, routing/firewall policy data, or network information.
7. Establish persistence or modify configuration to maintain access.
8. Use the compromised network device for traffic interception, defense evasion, internal scanning, or pivoting.

How to detect it

Investigate whether J-Web was reachable from untrusted networks during the exposure window and review logs for exploit attempts and post-exploitation activity. Relevant sources include J-Web/httpd access logs, Junos system logs, authentication logs, configuration change logs, command accounting logs, firewall logs, VPN/jump-host logs, NetFlow, EDR/NDR telemetry where available, and centralized SIEM records. Look for unauthenticated HTTP requests to J-Web containing PHPRC or PHP runtime directives, unusual POST requests, encoded payloads, references to php://input or data:// streams, and attempts to set auto_prepend_file or allow_url_include. After suspected exploitation, look for unexpected child processes spawned by the web service, shell command execution, new or modified local users, unauthorized configuration commits, changed firewall/routing/NAT/VPN policies, unexplained reboots, disabled logging, suspicious outbound connections from the device, and file artifacts in temporary or web-related directories. Because exploitation is known in the wild and may leave limited device-side evidence, absence of obvious indicators should not be treated as proof of no compromise if J-Web was exposed and the device was vulnerable.

• PHPRC=
• PHPRC%3d
• PHPRC%3D
• auto_prepend_file
• allow_url_include
• php://input
• data://
• expect://
• input_file=
• /var/log/httpd.log
• /var/log/messages
• /var/log/interactive-commands
• /var/tmp/
• /tmp/
• jweb
• J-Web
• POST /
• GET /
• User-Agent: curl
• User-Agent: python-requests
• User-Agent: Go-http-client
• ; wget
• ; curl
• /bin/sh
• /bin/bash
• chmod +x
• uname -a
• id;
• whoami
• set system login user
• delete system syslog
• commit confirmed
• commit and-quit

What your security team should do

• Immediately inventory Juniper EX Series and SRX Series assets, prioritizing internet-facing or broadly reachable J-Web interfaces.
• Patch or upgrade affected devices to the appropriate fixed Junos OS release; this should be treated as overdue because the KEV deadline was 2023-11-17.
• Disable J-Web on devices where web management is not operationally required.
• Restrict device management access to dedicated management networks, jump hosts, or VPN-enforced administrative paths.
• Search historical web, system, authentication, and configuration logs for PHPRC manipulation, suspicious PHP options, unexpected commands, and unauthorized configuration changes.
• If exposure is confirmed, assume potential compromise until investigated; preserve logs, collect forensic artifacts, and compare configuration against backups.
• Rotate local and centralized administrative credentials used on affected devices after patching and compromise assessment.
• Monitor for outbound connections, new files, unusual processes, or configuration changes originating from network devices.
• Add SIEM detections for HTTP requests containing PHPRC, auto_prepend_file, allow_url_include, data://, php://input, or other PHP configuration injection patterns.
• Review perimeter exposure management processes to ensure network appliance management interfaces are not internet-accessible by default.