Juniper Networks fixes flaws leading to RCE in firewalls and switches
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-36845 | Unauthenticated RCE in Juniper J-Web on EX and SRX Series A PHP external variable modification flaw (CVE-2023-36845) in the J-Web web management interface of Juniper Networks Junos OS on EX Series switches and SRX Series firewalls allows an unauthenticated, network-based attacker to remotely execute code. By sending a crafted request that sets the PHPRC variable, the attacker modifies the PHP execution environment to inject and execute code, gaining full control of the device with high impact on confidentiality, integrity, and availability (CVSS 9.8). All EX and SRX devices running affected Junos OS versions — from all builds prior to 20.4R3-S9 through the 23.2 line — are affected where the J-Web interface is reachable. Exploitation is confirmed in the wild: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on November 13, 2023, public PoC exploit code is available, and public scans found nearly 12,000 vulnerable Juniper firewalls exposed to the internet, prompting a CISA patch deadline of November 17. Do: Upgrade affected EX/SRX devices to a fixed Junos OS release: 20.4R3-S9, 21.2R3-S7, 21.3R3-S5, 21.4R3-S5, 22.1R3-S4, 22.2R3-S2, 22.3R2-S2 or 22.3R3-S1, 22.4R2-S1 or 22.4R3, or 23.2R1-S1 or 23.2R2 (or later). As an interim mitigation, disable J-Web or restrict access to trusted management networks, and review web interface logs for crafted requests setting PHPRC. Federal defenders should patch by CISA's November 17 KEV deadline. | 9.8 group max | 95% | KEV PoC ×2 |
| large≈12,000 internet-exposed Juniper firewalls (public vulnerability scans); total installed base likely higher |
Full article353 words · extracted from helpnetsecurity.com · click to collapse
Juniper Networks has fixed four vulnerabilities (CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, CVE-2023-36847) in Junos OS that, if chained together, could allow attackers to achieve remote code execution (RCE) on the company’s SRX firewalls and EX switches.
The fixed Junos OS vulnerabilities
Junos OS is an operating system based on Linux and FreeBSD that runs on Juniper Networks firewalls, network switches and other security devices. The affected component – J-Web – is the graphical user interface (GUI) used to manage devices running Junos.
CVE-2023-36844 and CVE-2023-36845 are PHP external variable modification vulnerabilities in J-Web of Juniper Networks Junos OS on EX Series and SRX Series that could allow an unauthenticated, network-based threat actor to control certain important environments variables.
CVE-2023-36846 and CVE-2023-36847 denote missing authentication for a critical function in Juniper Networks Junos OS on EX Series and SRX Series that could allow an unauthenticated, network-based threat actor to cause limited impact to the file system integrity.
“By chaining exploitation of these vulnerabilities, an unauthenticated, network-based attacker may be able to remotely execute code on the devices,” Juniper noted.
This is why the vulnerabilities have a 5.3 CVSS score separately, but when combined they become critical (CVSS 9.8). This also means that only one vulnerability needs to be patched per platform to prevent remote code execution.
These vulnerabilities were discovered by external security researchers.
Update or mitigate
Vulnerabilities in security and networking devices are often exploited by attackers to gain initial access to a target company’s network.
The company has resolved these security issues by releasing the following Junos OS versions:
- SRX Series – 20.4R3-S8, 21.2R3-S6, 21.3R3-S5, 21.4R3-S5, 22.1R3-S3, 22.2R3-S2, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3, 23.2R1, and all subsequent releases
- EX Series – 20.4R3-S8, 21.2R3-S6, 21.3R3-S5, 21.4R3-S4, 22.1R3-S3, 22.2R3-S1, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3, 23.2R1, and all subsequent releases
Users are recommended to update their Juniper Networks firewalls and switches as soon as possible. Alternatively, they can mitigate the risk of exploitation by disabling J-Web or by limiting access to trusted hosts only.
UPDATE (August 29, 2023, 02:25 p.m. ET):
After watchTowr researchers released a PoC exploit on August 25, the Shadowserver Foundation started noticing exploitation attempts.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2023/08/22/juniper-firewalls-switches-rce/