CVE-2023-36846 Juniper Junos OS SRX Series Missing Authentication for Critical Function
Unauthenticated attackers can upload arbitrary files to the SRX Series firewall via J-Web, compromising file system integrity.
- Exploited in the wild
- Since 13 Nov 2023
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-36846?
CVE-2023-36846 is a medium-severity vulnerability in Juniper Junos, published on 17 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.
With a specific request to user.php that doesn't require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of
integrity
for a certain
part of the file system, which may allow chaining to other vulnerabilities.
This issue affects Juniper Networks Junos OS on SRX Series:
* All versions prior to 20.4R3-S8; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S6; * 21.3 versions
prior to
21.3R3-S5; * 21.4 versions
prior to
21.4R3-S5; * 22.1 versions
prior to
22.1R3-S3; * 22.2 versions
prior to
22.2R3-S2; * 22.3 versions
prior to
22.3R2-S2, 22.3R3; * 22.4 versions
prior to
22.4R2-S1, 22.4R3.
Weakness: CWE-306
Which versions are affected by CVE-2023-36846?
It affects 1 product.
Products include Juniper Junos.
How do I fix CVE-2023-36846?
No fix has been published for CVE-2023-36846 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 17 Nov 2023.
Is CVE-2023-36846 being exploited?
Yes. Attackers have exploited CVE-2023-36846 in the wild since at least 13 Nov 2023.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Juniper Junos
- CVE-2023-36845 Juniper Junos OS EX Series and SRX Series PHP External Variable Modification
- CVE-2020-1631 Juniper Junos OS Path Traversal
- CVE-2025-21590 Juniper Junos OS Improper Isolation or Compartmentalization
- CVE-2023-36851 Juniper Junos OS SRX Series Missing Authentication for Critical Function
- CVE-2023-36844 Juniper Junos OS EX Series PHP External Variable Modification
Sources
Also known as GHSA-rrhw-mwxf-m9mp.