CVE-2023-36847

What it actually does

CVE-2023-36847 is a missing-authentication vulnerability in Juniper Junos OS J-Web on EX Series switches. The vulnerable installAppPackage.php function can be reached by an unauthenticated network attacker and can be abused to upload arbitrary files to a limited portion of the device file system. By itself, the documented impact is limited file-system integrity loss, but it is security-significant because uploaded files may be used to stage payloads, alter web-accessible content, or chain with other Junos/J-Web vulnerabilities to achieve broader compromise.

Why it matters to the business

Affected EX Series switches expose a management-plane weakness that can let an external or internal attacker tamper with files on network infrastructure without logging in. Because this vulnerability is listed in CISA KEV, has active in-the-wild exploitation, and has a high EPSS score, internet- or broadly reachable J-Web interfaces should be treated as urgent. Successful exploitation can undermine trust in switch management, support follow-on compromise of network devices, and create operational risk for switching, segmentation, and incident response activities.

How an attack unfolds

An attacker first identifies an EX Series switch with J-Web exposed over the network. They then send a crafted unauthenticated HTTP request to the J-Web installAppPackage.php endpoint. Because the endpoint does not properly require authentication for a critical file-installation function, the attacker can upload attacker-controlled content into a writable area associated with the application package workflow. The immediate result is unauthorized file creation or modification in a limited part of the file system. In real-world exploitation, this type of primitive is commonly used as a staging step: the attacker may place payloads, probe for accessible file paths, attempt to write web-reachable content, or combine the upload with other J-Web issues to escalate from file write to command execution or persistent device compromise.

How to fix it

Upgrade affected Juniper Junos OS EX Series devices to a fixed release. Based on the advisory, fixed or non-affected target releases include 20.4R3-S8 or later; 21.2R3-S6 or later; 21.3R3-S5 or later; 21.4R3-S4 or later; 22.1R3-S3 or later; 22.2R3-S1 or later; 22.3R2-S2, 22.3R3, or later; and 22.4R2-S1, 22.4R3, or later. Junos OS 21.1 is listed as affected, so migrate from that train to a fixed supported train rather than remaining on 21.1. If immediate upgrade is not possible, disable J-Web where operationally feasible, restrict management access to trusted administrative networks and VPNs, block untrusted access to HTTP/HTTPS management ports, and ensure management interfaces are not exposed to the internet. Treat mitigation as temporary because this vulnerability is in the CISA KEV catalog and has active exploitation.

How to confirm the fix worked

Confirm the running Junos OS version on every EX Series device and compare it against the fixed release thresholds. Verify that J-Web is disabled if not required, or that HTTP/HTTPS management access is limited to trusted source networks. From an untrusted network segment, confirm that J-Web ports are not reachable. Review web management logs for unauthenticated requests to /installAppPackage.php before and after remediation. If a compensating control such as ACL filtering is used, validate that direct requests to the J-Web interface and to /installAppPackage.php are blocked from non-administrative networks.

Typical attack path

1. Scan for Juniper EX Series devices with J-Web exposed on management HTTP or HTTPS ports.
2. Fingerprint Junos/J-Web version or test for reachability of vulnerable J-Web PHP endpoints.
3. Send an unauthenticated crafted upload request to /installAppPackage.php.
4. Place an attacker-controlled file in a writable J-Web/application package location.
5. Attempt to access, trigger, or chain the uploaded file with another vulnerability or misconfiguration.
6. Use any achieved foothold to modify device state, stage additional tools, collect configuration, or pivot through the management network.

How to detect it

Review J-Web, HTTP/HTTPS management, reverse proxy, firewall, and network telemetry for requests to the J-Web installAppPackage.php endpoint. Prioritize POST requests, multipart/form-data uploads, requests from non-administrative IP addresses, requests without an authenticated management session, and repeated probing of PHP files under the J-Web interface. On the device, review Junos system and web logs around suspicious request times, including logs that record HTTP requests, authentication events, file installation activity, package installation activity, and errors from PHP or the web management service. Look for unexpected files created near the time of suspicious requests, unusual application package artifacts, modified web content, or follow-on access to newly uploaded files. Because this vulnerability can be chained, also investigate adjacent indicators such as unexpected configuration changes, new administrative users, unexplained reboots, abnormal outbound connections from management interfaces, or additional J-Web exploit attempts in the same session or source IP history.

• /installAppPackage.php
• POST /installAppPackage.php
• GET /installAppPackage.php
• installAppPackage.php
• multipart/form-data
• Content-Disposition: form-data
• J-Web
• /var/log/messages
• /var/log/httpd.log

What your security team should do

• Prioritize remediation as an emergency or high-priority change for any EX Series switch with J-Web reachable from untrusted networks, because the issue is KEV-listed and actively exploited.
• Inventory all Juniper EX Series devices and record Junos train, exact version, J-Web status, and management-plane exposure.
• Upgrade to a fixed Junos OS release; move any 21.1 deployments to a fixed supported train.
• Disable J-Web where it is not operationally required.
• Restrict switch management access using dedicated management networks, firewall rules, routing controls, and administrative VPNs.
• Search historical logs for requests to /installAppPackage.php, especially unauthenticated POST requests or multipart uploads.
• If suspicious activity is found, preserve logs and device state, inspect for unexpected files or configuration changes, rotate administrative credentials, and consider rebuilding or reimaging affected devices from trusted media.
• Add SIEM detections for J-Web upload attempts and alert on any access to installAppPackage.php from non-administrative sources.