CISA adds five vulnerabilities in Juniper devices to its Known Exploited Vulnerabilities catalog
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-36845 | Unauthenticated RCE in Juniper J-Web on EX and SRX Series A PHP external variable modification flaw (CVE-2023-36845) in the J-Web web management interface of Juniper Networks Junos OS on EX Series switches and SRX Series firewalls allows an unauthenticated, network-based attacker to remotely execute code. By sending a crafted request that sets the PHPRC variable, the attacker modifies the PHP execution environment to inject and execute code, gaining full control of the device with high impact on confidentiality, integrity, and availability (CVSS 9.8). All EX and SRX devices running affected Junos OS versions — from all builds prior to 20.4R3-S9 through the 23.2 line — are affected where the J-Web interface is reachable. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on November 13, 2023, public PoC exploit code is available, and public scans found nearly 12,000 vulnerable Juniper firewalls exposed to the internet, prompting a CISA patch deadline of November 17. Do: Upgrade affected EX/SRX devices to a fixed Junos OS release: 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S2, 22.3R2-S2 or 22.3R3-S1, 22.4R2-S1 or 22.4R3, or 23.2R1-S1 or 23.2R2 (or later). As an interim mitigation, disable J-Web or restrict access to trusted management networks, and review web interface logs for crafted requests setting PHPRC. Federal defenders should patch by CISA's November 17 KEV deadline. | 9.8 group max | 95% | KEV PoC ×2 |
| large≈12,000 internet-exposed Juniper firewalls (public vulnerability scans); total installed base likely higher | |
| CVE-2023-36851 | Unauthenticated Arbitrary File Upload/Download in Juniper SRX Series J-Web This is a missing-authentication flaw (CWE-306) in the J-Web web management interface of Juniper Networks Junos OS running on SRX Series firewalls. An unauthenticated, network-based attacker can send a crafted request to webauth_operation.php, which requires no authentication, and upload or download arbitrary files on the device. The result is limited loss of file system integrity and potential loss of confidentiality, and the file access may be chained with other vulnerabilities to increase impact. Any organization running an affected Junos OS release on an SRX Series device with J-Web enabled is affected, especially where that interface is reachable from untrusted networks. Exploitation is confirmed in the wild: CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2023-11-13 as one of five Juniper flaws and set a patch deadline of November 17, 2023. Do: Upgrade affected SRX Series devices to the fixed releases: 21.2R3-S8, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R2-S2 or 22.4R3, or 23.2R1-S2 or 23.2R2 (or later). As an interim mitigation, disable J-Web or restrict it to trusted management networks and interfaces only. Review device logs for unauthenticated requests to webauth_operation.php as evidence of exploitation, and prioritize patching given the CISA KEV deadline of November 17, 2023. | 5.3 | 1% | KEV |
| largetens of thousands of internet-exposed SRX firewalls with J-Web enabled (a subset of a very large installed base) | |
| CVE-2023-47246 | Unauthenticated Path Traversal RCE in SysAid On-Premise Server CVE-2023-47246 is a critical (CVSS 9.8) path traversal flaw (CWE-22) in SysAid On-Premise before version 23.3.36 that allows an unauthenticated, network-located attacker to write attacker-controlled files into the Tomcat webroot of the SysAid server. Once a file is written into that webroot, it is executed by the Tomcat application server, resulting in remote code execution on the ITSM server. Because the flaw requires no authentication or user interaction, any internet-exposed SysAid On-Premise server is directly reachable, and compromise can lead to data theft and ransomware deployment; the Lace Tempest group behind the MOVEit attacks has exploited it, and ransomware use is known. Only SysAid On-Premise deployments are affected, and the vendor fixed the issue in version 23.3.36. The vulnerability is confirmed exploited in the wild, was added to CISA's Known Exploited Vulnerabilities catalog on 2023-11-13, and carries a 98.9% EPSS probability of exploitation within 30 days. Do: Upgrade SysAid On-Premise to version 23.3.36 or later immediately, per the vendor's security notification. Because this is KEV-listed with known ransomware use by Lace Tempest, also inspect the Tomcat webroot and deployed webapps for unauthorized files (e.g., WAR files), review for unauthorized accounts and unusual processes, and check for signs of lateral movement on compromised hosts. Organizations unable to patch should apply mitigations per the vendor's instructions or discontinue use of the product, per the CISA required action. | 9.8 | 99% | KEV ransomware PoC |
| moderate≈ a few thousand internet-exposed SysAid On-Premise servers (SysAid's overall customer base is on the order of tens of thousands of organizations, and only the… |
Full article903 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
November 13, 2023
US CISA added four vulnerabilities (tracked as CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847) in Juniper devices to its Known Exploited Vulnerabilities catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six new vulnerabilities to its Known Exploited Vulnerabilities catalog, five issues impacting Juniper Junos OS and one impacting the SysAid SysAid IT support software.
Below is the list of the added vulnerabilities:
- CVE-2023-47246 SysAid Server Path Traversal Vulnerability
- CVE-2023-36844 Juniper Junos OS EX Series PHP External Variable Modification Vulnerability
- CVE-2023-36845 Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
- CVE-2023-36846 Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
- CVE-2023-36847 Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
- CVE-2023-36851 Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
According to Juniper SIRT, the vulnerabilities in J-Web can be combined to allow an attacker to achieve preAuth Remote Code Execution. The vendor also confirmed that threat actors are chaining the issues in attacks in the wild.
“Juniper SIRT is now aware of successful exploitation of these vulnerabilities. Customers are urged to immediately upgrade.” states the update published by the company on November 8th 2023.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix these vulnerabilities by November 17, 2023, while the SysAid Server Path Traversal Vulnerability must be addressed by December 4, 2023.
Juniper addressed four medium-severity (CVSS 5.3) vulnerabilities (CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, CVE-2023-36847) in In mid-August.
The vulnerabilities reside in the J-Web component of Juniper Networks Junos OS on SRX Series and EX Series.
“Multiple vulnerabilities in the J-Web component of Juniper Networks Junos OS on SRX Series and EX Series have been resolved through the application of specific fixes to address each vulnerability.” reads the advisory published by Juniper. “By chaining exploitation of these vulnerabilities, an unauthenticated, network-based attacker may be able to remotely execute code on the devices.”
“With a specific request that doesn’t require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities,” says Juniper.
The company also suggests disabling J-Web, or limiting access to only trusted hosts, as a workaround for this flaw.
At the end of August, watchTowr Labs security researchers published a proof-of-concept exploit (PoC) exploit code for vulnerabilities in Juniper SRX firewalls. An unauthenticated attacker can chain the vulnerabilities to gain remote code execution in Juniper JunOS on vulnerable devices.
watchTowr Labs security researchers exploited a pre-authentication upload vulnerability (CVE-2023-36846) to upload an arbitrary PHP file to a restricted directory with a randomised file name. Then they exploited the same vulnerable function to upload a PHP configuration file (.ini) which points to and loads the above PHP file using the auto_prepend_file directive.
As all environment variables can be set via HTTP requests, the researchers exploited the CVE-2023-36845 to overwrite the environment variable PHPRC and load the PHP configuration file and trigger the execution of the PHP file initially uploaded.
watchTowr also published a deep dive into reproducing, chaining and exploiting these vulnerabilities.
“This is an interesting bug chain, utilising two bugs that would be near-useless in isolation and combining them for a ‘world ending’ unauthenticated RCE.” explained the researchers.
“Given the simplicity of exploitation, and the privileged position that JunOS devices hold in a network, we would not be surprised to see large-scale exploitation.” continues the experts.
In Mid-September, VulnCheck researchers discovered approximately 12,000 internet-exposed Juniper SRX firewalls and EX switches that are vulnerable to the recently disclosed remote code execution flaw CVE-2023-36845.
VulnCheck developed a new exploit for the flaw CVE-2023-36845 that can be used by an unauthenticated and remote attacker to execute arbitrary code on Juniper firewalls without creating a file on the system.
Unlike the previous exploit, the one developed by VulnCheck can be written using a single cURL command and impacts older versions.
“The Juniper firewalls use the Appweb web server. When Appweb invokes a CGI script, it passes a variety of environment variables and arguments so that the script can access the user’s HTTP request. The body of the HTTP request is passed via stdin. The affected firewalls run FreeBSD, and every FreeBSD process can access their stdin by opening /dev/fd/0. By sending an HTTP request, we’re able to introduce a “file”, /dev/fd/0, to the system.” reads the analysis published by VulnCheck. “Using that trick, we can set the PHPRC environment variable to /dev/fd/0 and include the desired php.ini in our HTTP request.”
According to the cyber security firm, approximately 80% of affected internet-facing firewalls remain unpatched.
VulnCheck developed a vulnerability scanner to identify firewalls vulnerable to CVE-2023-36845. Using Shodan the experts discovered approximately 15,000 Juniper devices with internet-facing web interfaces.
“Firewalls are interesting targets to APT as they help bridge into the protected network and can serve as useful hosts for C2 infrastructure. Anyone who has an unpatched Juniper firewall should examine it for signs of compromise.” concludes the experts.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/154128/security/cisa-juniper-flaws-known-exploited-vulnerabilities-catalog.html