Home > Security Bulletins > Juniper Junos OS remote code vulnerabilities

Juniper Junos OS remote code vulnerabilities

Request an audit
Network high-level design
Juniper Junos OS remote code vulnerabilities

1 September 2023

Juniper confirmed multiple vulnerabilities in its Junos OS (SRX Series and EX Series). Juniper has released updates and a workaround for the security vulnerability. Proof of concept exploit code is publicly available. The exploit allows unauthorized attackers to gain remote code execution in the JunOS.

CVE-2023-36844 (CVSS 3.1: 5.3) A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environments variables. Utilizing a crafted request an attacker is able to modify certain PHP environments variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.

CVE-2023-36845 (CVSS 3.1: 5.3) A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain, important environments variables. Utilizing a crafted request an attacker is able to modify a certain PHP environment variable leading to partial loss of integrity, which may allow chaining to other vulnerabilities.

CVE-2023-36846 (CVSS 3.1: 5.3) A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request that doesn’t require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain  part of the file system, which may allow chaining to other vulnerabilities.

CVE-2023-36847 (CVSS 3.1: 5.3) A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request that doesn’t require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities.

 

Affected Products

These issues affect Juniper Networks Junos OS on SRX Series:

  • All versions prior to 20.4R3-S8;
  • 21.1 version 21.1R1 and later versions;
  • 21.2 versions prior to 21.2R3-S6;
  • 21.3 versions prior to 21.3R3-S5;
  • 21.4 versions prior to 21.4R3-S5;
  • 22.1 versions prior to 22.1R3-S3;
  • 22.2 versions prior to 22.2R3-S2;
  • 22.3 versions prior to 22.3R2-S2, 22.3R3;
  • 22.4 versions prior to 22.4R2-S1, 22.4R3;

These issues affect Juniper Networks Junos OS on EX Series:

  • All versions prior to 20.4R3-S8;
  • 21.1 version 21.1R1 and later versions;
  • 21.2 versions prior to 21.2R3-S6;
  • 21.3 versions prior to 21.3R3-S5;
  • 21.4 versions prior to 21.4R3-S4;
  • 22.1 versions prior to 22.1R3-S3;
  • 22.2 versions prior to 22.2R3-S1;
  • 22.3 versions prior to 22.3R2-S2, 22.3R3;
  • 22.4 versions prior to 22.4R2-S1, 22.4R3.

Security Updates

Juniper has released a workaround and updated software to resolves this issue:
For EX Series, the following releases have resolved this: 20.4R3-S8, 21.2R3-S6, 21.3R3-S5, 21.4R3-S4, 22.1R3-S3, 22.2R3-S1, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3, 23.2R1, and all subsequent releases.

For SRX Series, the following releases have resolved this via PR 1735389: 20.4R3-S8, 21.2R3-S6, 21.3R3-S5, 21.4R3-S5, 22.1R3-S3, 22.2R3-S2, 22.3R2-S2, 22.3R3, 22.4R2-S1, 22.4R3, 23.2R1, and all subsequent releases.

More information from Juniper, link