CVE-2023-36851

What it actually does

This is an authentication bypass in Juniper Networks Junos OS J-Web on SRX Series devices. The vulnerable J-Web handler, webauth_operation.php, exposes file upload and file download functionality without requiring a valid authenticated management session. A remote network attacker who can reach the J-Web management interface can make crafted requests to that endpoint and affect file-system confidentiality or integrity. The standalone CVSS impact is limited because the issue does not directly provide full device control, but it is security-significant because arbitrary file read/write primitives on a firewall or VPN edge device may be chained with other J-Web or Junos weaknesses to gain broader access, persistence, credential exposure, or code execution.

Why it matters to the business

Exploitation can let an unauthenticated attacker tamper with or retrieve files from internet-facing or network-accessible SRX firewall management interfaces. Because SRX devices commonly sit at network boundaries, compromise or tampering can affect security enforcement, incident response visibility, remote access, and trust in network segmentation. The vulnerability is listed in CISA KEV with a remediation due date of 2023-11-17 and is marked as actively exploited in the wild, so organizations should treat exposed J-Web interfaces as high-priority even though the base CVSS score is moderate and EPSS is relatively low. The provided affected-product metadata includes unrelated shim package entries; remediation should be validated against Juniper Junos OS SRX advisories and actual SRX/Junos inventory.

How an attack unfolds

An attacker first identifies an SRX Series device with J-Web enabled and reachable over the network, often by scanning for exposed Juniper management HTTPS/HTTP services. The attacker then sends unauthenticated requests to the J-Web webauth_operation.php endpoint. On vulnerable Junos OS releases, the endpoint does not correctly enforce authentication for critical file operations, allowing the attacker to upload files to writable locations or download accessible files without logging in. The attacker may use this access to stage files, alter device-resident content, retrieve sensitive configuration-adjacent data, or combine the primitive with additional Junos/J-Web vulnerabilities to escalate impact. Since this issue is in the CISA Known Exploited Vulnerabilities catalog, defenders should assume that public-facing J-Web exposure may have been probed or exploited and should perform retrospective log review in addition to patching.

How to fix it

Upgrade affected Juniper Networks Junos OS SRX Series devices to a fixed release or later: 21.2R3-S8 or later for 21.2; 21.4R3-S6 or later for 21.4; 22.1R3-S5 or later for 22.1; 22.2R3-S3 or later for 22.2; 22.3R3-S2 or later for 22.3; 22.4R2-S2, 22.4R3, or later for 22.4; and 23.2R1-S2, 23.2R2, or later for 23.2. If immediate upgrade is not possible, disable J-Web management where operationally feasible, restrict J-Web to a dedicated management network or VPN, block internet access to the management interface, and allow only trusted administrative source addresses. Review Juniper advisories for any recommended companion fixes, because this issue may be used as part of exploit chains. Do not rely on unrelated package fixed versions such as rhboot/shim or Ubuntu shim entries for remediation of Junos SRX devices.

How to confirm the fix worked

Confirm the running Junos OS version on each SRX device and verify it is at or above the fixed release for its train. Confirm J-Web exposure by reviewing device configuration for web-management services and by scanning only approved management ranges for HTTP/HTTPS management listeners. After upgrade or mitigation, unauthenticated requests to /webauth_operation.php should not permit file upload or download behavior and should return an authentication, authorization, redirect-to-login, or not-found response rather than performing file operations. Validate that management-plane ACLs, firewall filters, or security policies restrict J-Web access to approved administrative networks only. Perform external and internal exposure checks to ensure J-Web is not reachable from untrusted networks.

Typical attack path

1. Discover SRX Series devices exposing J-Web over HTTP or HTTPS.
2. Fingerprint the Junos OS/J-Web service and identify systems running affected release trains.
3. Send unauthenticated requests to /webauth_operation.php.
4. Use the missing-authentication condition to upload or download files through J-Web functionality.
5. Review downloaded data or place attacker-controlled files in writable locations.
6. Optionally chain the file read/write primitive with other vulnerabilities or misconfigurations to gain greater access, persistence, or operational impact.
7. Remove or blend in artifacts and continue probing the management interface.

How to detect it

Review logs from SRX devices, centralized syslog, web management logs, reverse proxies, VPN concentrators, firewall flow logs, IDS/IPS, and SIEM records for requests to /webauth_operation.php, especially from unauthenticated sessions, unknown external IP addresses, or sources outside approved management networks. Look for HTTP POST or GET requests to that endpoint, repeated probing of J-Web paths, unusual response sizes indicating file download, and requests shortly followed by other J-Web exploit attempts. Examine Junos logs for management service access from unexpected addresses and for configuration or file-system changes that do not align with authorized administrative activity. If web logs are unavailable on-device, use perimeter telemetry to identify traffic to SRX management ports, commonly TCP/443 or TCP/80, with URI paths containing webauth_operation.php. Forensic review should include checking writable temporary and web-accessible directories for unexpected files and correlating timestamps with J-Web access events. Because the vulnerability is KEV-listed and actively exploited, absence of a known named threat actor should not reduce priority; broad opportunistic scanning is plausible.

• webauth_operation.php
• /webauth_operation.php
• GET /webauth_operation.php
• POST /webauth_operation.php
• "GET /webauth_operation.php"
• "POST /webauth_operation.php"
• J-Web
• /var/log/httpd.log
• /var/log/messages
• tcp/443 requests containing /webauth_operation.php
• tcp/80 requests containing /webauth_operation.php

What your security team should do

• Immediately inventory Juniper SRX Series devices and identify any running affected Junos OS release trains.
• Prioritize remediation for SRX devices with J-Web reachable from the internet, partner networks, user networks, or other untrusted segments.
• Upgrade to the applicable fixed Junos OS release or later; if upgrade must be delayed, disable J-Web or restrict it to trusted management networks only.
• Treat this as urgent despite moderate CVSS because it is in CISA KEV, has documented in-the-wild exploitation, and affects security boundary devices.
• Search historical web management logs, reverse proxy logs, firewall logs, and SIEM telemetry for unauthenticated access to webauth_operation.php.
• Review SRX file systems and configuration state for unexpected files or unexplained changes around the suspected exposure window.
• Assess for exploit chaining with other Junos/J-Web vulnerabilities if suspicious requests are found.
• Ensure J-Web management is not exposed broadly as a long-term hardening control.