Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files
CVE-2023-36851

5.3MEDIUM

Key Information:

Vendor

Juniper Networks
Status
Junos Os
Vendor
CVE Published:
27 September 2023

Badges

👾 Exploit Exists🟣 EPSS 11%🦅 CISA Reported📰 News Worthy

What is CVE-2023-36851?

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity.

With a specific request to

webauth_operation.php

that doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of

integrity or confidentiality, which may allow chaining to other vulnerabilities.

This issue affects Juniper Networks Junos OS on SRX Series:

21.2 versions prior to 21.2R3-S8;

  • 21.4

versions prior to

21.4R3-S6;

  • 22.1

versions prior to

22.1R3-S5;

  • 22.2

versions prior to

22.2R3-S3;

  • 22.3

versions prior to

22.3R3-S2;

  • 22.4 versions prior to 22,4R2-S2, 22.4R3;
  • 23.2 versions prior to

23.2R1-S2, 23.2R2.

CISA has reported CVE-2023-36851

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2023-36851 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

Junos OS SRX Series 21.2 < 21.2R3-S8

Junos OS SRX Series 21.4 < 21.4R3-S6

Junos OS SRX Series 22.1 < 22.1R3-S5

News Articles

favicon imageThe Hacker News

CISA Sets a Deadline - Patch Juniper Junos OS Flaws Before November 17

Juniper Junos OS vulnerabilities can lead to remote code execution. CISA has set a Nov 17, 2023 deadline to secure against Juniper Junos OS vulnerabil

References

https://supportportal.juniper.net/JSA72300
vendor-advisorymitigation

EPSS Score

11% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 📰

    First article discovered by The Hacker News

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

Credit

The Juniper SIRT would like to acknowledge and thank watchtowr for responsibly reporting this vulnerability.
.