CVE-2023-36844

CVE-2023-36844 is a PHP external variable modification flaw (CWE-473) in the J-Web web-management interface of Juniper Networks Junos OS on EX Series switches. An unauthenticated, network-based attacker can send a crafted request to J-Web to modify important PHP environment variables, causing a partial loss of integrity that, when chained with other recently disclosed Junos J-Web flaws, enables full unauthenticated remote code execution as demonstrated in a public proof-of-concept. Nearly all current Junos releases on EX Series are affected, spanning all versions prior to 20.4R3-S9 through 23.2 versions prior to 23.2R1-S1 and 23.2R2. Exploitation is confirmed in the wild: CISA added the flaw to the Known Exploited Vulnerabilities catalog on November 13, 2023 with a remediation deadline of November 17, 2023, and threat actors began exploiting the Juniper flaw family shortly after PoC code was released. Public internet scans have already identified nearly 12,000 vulnerable Juniper devices, underscoring broad exposure of internet-facing J-Web interfaces.

What to do: Upgrade EX Series devices to a fixed Junos release: 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S2, 22.3R3-S1, 22.4R2-S2 or 22.4R3, or 23.2R1-S1 or 23.2R2; the 21.1 train (21.1R1 and later) has no fixed 21.1 version listed, so move to a fixed later release. As an interim mitigation, disable J-Web or restrict it to trusted management networks, and inventory internet-facing Junos devices for compromise; CISA's KEV required action is to apply vendor mitigations or discontinue use of the product if mitigations are unavailable.