CVE-2023-36845 Juniper Junos OS EX Series and SRX Series PHP External Variable Modification
Unauthenticated attackers can remotely execute code on Juniper EX and SRX devices by manipulating PHP environment variables via J-Web.
- Exploited in the wild
- Since 13 Nov 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-36845?
CVE-2023-36845 is a critical code injection vulnerability in Juniper Junos, published on 17 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series
and SRX Series
allows an unauthenticated, network-based attacker to remotely execute code.
Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
This issue affects Juniper Networks Junos OS on EX Series
and
SRX Series:
* All versions prior to
20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions
prior to
22.1R3-S4; * 22.2 versions
prior to
22.2R3-S2; * 22.3 versions
prior to
22.3R2-S2, 22.3R3-S1; * 22.4 versions
prior to
22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.
Weakness: CWE-473
Which versions are affected by CVE-2023-36845?
It affects 1 product.
Products include Juniper Junos.
How do I fix CVE-2023-36845?
No fix has been published for CVE-2023-36845 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Nov 2023.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2023-36845 being exploited?
Yes. Attackers have exploited CVE-2023-36845 in the wild since at least 13 Nov 2023.
Public exploit code: 1 Metasploit module, 1 Nuclei template and 17 proofs of concept on GitHub.
Other vulnerabilities in Juniper Junos
- CVE-2020-1631 Juniper Junos OS Path Traversal
- CVE-2025-21590 Juniper Junos OS Improper Isolation or Compartmentalization
- CVE-2023-36851 Juniper Junos OS SRX Series Missing Authentication for Critical Function
- CVE-2023-36844 Juniper Junos OS EX Series PHP External Variable Modification
- CVE-2023-36846 Juniper Junos OS SRX Series Missing Authentication for Critical Function
Sources
Also known as GHSA-q56g-qr28-qh57.