CVE-2023-36846

What it actually does

CVE-2023-36846 is a missing-authentication flaw in Juniper Junos OS J-Web on SRX Series devices. An unauthenticated network attacker can send a crafted request to the J-Web user.php endpoint and upload arbitrary files to a limited portion of the device file system. By itself, the issue is primarily an integrity impact, but because SRX devices are perimeter security appliances and J-Web runs in a privileged management context, arbitrary file placement can be used as a staging step for web shells, persistence files, configuration tampering, or chaining with other Junos/J-Web vulnerabilities to gain broader control.

Why it matters to the business

Compromise of an SRX firewall or gateway can undermine the security boundary protecting an organization. Even though the standalone CVSS impact is limited, this vulnerability is in CISA KEV, has very high EPSS likelihood, and is reported as actively exploited in the wild, so exposed J-Web interfaces should be treated as urgent remediation targets. Operational consequences may include unauthorized changes to a security appliance, foothold establishment on the network edge, traffic interception or redirection when chained with other flaws, outage risk during incident response, and loss of confidence in firewall integrity.

How an attack unfolds

An attacker first identifies an internet- or network-accessible Juniper SRX device with J-Web enabled. The attacker then sends an unauthenticated request to the vulnerable user.php endpoint, abusing the missing authentication check to upload an arbitrary file into a writable area of the appliance file system. If the uploaded file is executable, reachable by J-Web, or usable by another vulnerable component, the attacker may attempt to invoke it or combine it with additional Junos/J-Web vulnerabilities to escalate from limited file-write capability to command execution, persistence, credential theft, or appliance configuration manipulation. Because this vulnerability is known to be exploited in the wild and has a high EPSS score, exploitation attempts should be assumed likely for any exposed vulnerable SRX management interface.

How to fix it

Upgrade Juniper Junos OS on affected SRX Series devices to a fixed release. Fixed releases include 20.4R3-S8 or later for 20.4, 21.2R3-S6 or later for 21.2, 21.3R3-S5 or later for 21.3, 21.4R3-S5 or later for 21.4, 22.1R3-S3 or later for 22.1, 22.2R3-S2 or later for 22.2, 22.3R2-S2, 22.3R3 or later for 22.3, and 22.4R2-S1, 22.4R3 or later for 22.4. All 21.1 releases are affected and should be migrated to a fixed supported train. If immediate upgrade is not possible, disable J-Web or restrict J-Web access to a dedicated management network or VPN with trusted administrative source IPs only. Do not expose J-Web to the public internet. After patching, review the appliance for unauthorized files or configuration changes, rotate administrative credentials if compromise is suspected, and consider rebuilding from trusted media if evidence of successful exploitation or chaining is found.

How to confirm the fix worked

Confirm the installed Junos OS version on every SRX device and verify it is at or above the fixed release for its train. Confirm J-Web is disabled where not required, or reachable only from approved management networks. Externally validate that TCP/80 and TCP/443 management interfaces are not exposed to untrusted networks. Review web access logs for unauthenticated requests to user.php, especially POST requests or multipart uploads, before and after remediation. Where possible, compare J-Web directories and writable file-system locations against a known-good baseline and verify no unexpected files were created around suspicious request timestamps. A successful fix should show a fixed Junos release installed, management exposure reduced, and no continuing unauthenticated upload behavior against user.php.

Typical attack path

1. Scan for Juniper SRX devices with J-Web reachable over HTTP or HTTPS.
2. Fingerprint the appliance and Junos/J-Web version where possible.
3. Send an unauthenticated crafted request to the J-Web user.php endpoint.
4. Upload an attacker-controlled file into a writable area of the device file system.
5. Attempt to access, execute, or leverage the uploaded file directly or through another vulnerability.
6. Chain with additional vulnerabilities or misconfigurations to gain code execution, persistence, configuration access, or control of the appliance.
7. Use the compromised edge device for reconnaissance, traffic manipulation, credential capture, lateral movement, or as a durable network foothold.

How to detect it

Review Juniper SRX/J-Web HTTP access logs, reverse proxy logs if J-Web is proxied, firewall flow logs, VPN or management-network access logs, and Junos system logs for unauthenticated access to user.php. Focus on POST requests, multipart/form-data uploads, unusual request sizes, repeated probing, requests from internet sources, and requests followed by access to newly created files or other J-Web endpoints. Correlate suspicious user.php activity with file modification timestamps on the appliance and with administrative events such as configuration changes, login attempts, account creation, or service enablement. Because this vulnerability is commonly useful as part of a chain, also look for subsequent errors, crashes, shell-like commands in logs, unexpected outbound connections from the appliance, and signs that other Junos/J-Web vulnerabilities were attempted. Treat any successful unauthenticated POST to user.php from an untrusted source as a high-confidence incident requiring appliance integrity review.

• /user.php
• POST /user.php
• GET /user.php
• user.php
• multipart/form-data
• Content-Disposition: form-data
• J-Web
• Juniper J-Web
• /var/log/httpd.log

What your security team should do

• Immediately inventory Juniper SRX Series devices and identify any running affected Junos OS versions or exposed J-Web interfaces.
• Prioritize remediation as an emergency for internet-facing devices because the issue is in CISA KEV, exploitation is active in the wild, the KEV due date has passed, and EPSS likelihood is very high.
• Upgrade to the appropriate fixed Junos OS release or move affected 21.1 deployments to a fixed supported release train.
• Disable J-Web if not operationally required; otherwise restrict access to trusted management networks and enforce administrative access through VPN or bastion controls.
• Search historical web and system logs for requests to /user.php, unauthenticated POST activity, multipart uploads, unusual HTTP user agents, and file creation events around the same timestamps.
• Inspect appliances for unexpected files, web-accessible scripts, unauthorized configuration changes, new users, altered authentication settings, and signs of chained exploitation.
• If exploitation is suspected, isolate the appliance management interface, preserve logs and file-system artifacts, rotate credentials, review firewall/VPN configuration integrity, and consider reimaging or replacing the device from trusted media.
• Add detection content for Juniper J-Web upload attempts and alert on any future access to user.php from non-management sources.