CVE-2023-36845
Juniper Junos OS: EX Series and SRX Series PHP External Variable Modification
As of , CVE-2023-36845 in Juniper Junos OS is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch this week.
- Exploited
- Yes: CISA listed it on 13 November 2023
- US federal deadline
- 17 November 20234 days after CISA listed it. US federal civilian agencies must fix it by then.
- Used in ransomware campaigns
- Not known to CISA
- EPSS score
- 0.95Higher than 99% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
- EPSS when listed
- 0.38 on 13 November 2023EPSS on the day CISA listed it.
- Public exploit
- 1 Metasploit module
- Fix
- Vendor advice: supportportal.juniper.netLinks below, from CISA's entry.
What CISA says to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA's required action
What the flaw is
Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.
CISA's description
A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to remotely execute code. Using a crafted request which sets the variable PHPRC an attacker is able to modify the PHP execution environment allowing the injection und execution of code. This issue affects Juniper Networks Junos OS on EX Series and SRX Series: * All versions prior to 20.4R3-S9; * 21.1 versions 21.1R1 and later; * 21.2 versions prior to 21.2R3-S7; * 21.3 versions prior to 21.3R3-S5; * 21.4 versions prior to 21.4R3-S5; * 22.1 versions prior to 22.1R3-S4; * 22.2 versions prior to 22.2R3-S2; * 22.3 versions prior to 22.3R2-S2, 22.3R3-S1; * 22.4 versions prior to 22.4R2-S1, 22.4R3; * 23.2 versions prior to 23.2R1-S1, 23.2R2.
The CVE record's description, from juniper
- CVE published
- 17 August 2023
- Assigned by
- juniper
- CVSS
- 9.8 Critical (CVSS 3.1, from the CNA)
- CWE-473
- PHP External Variable Modification
- CISA SSVC, exploitation
- active
- CISA SSVC, automatable
- yes
- CISA SSVC, technical impact
- total
Timeline
- The CVE record was published.
- CISA added it to its list of exploited vulnerabilities.
- The US federal deadline to fix it.
Public exploits
Facts from Metasploit's module list and Exploit-DB's index; we never copy exploit code.
- Metasploit: Junos OS PHPRC Environment Variable Manipulation RCEexploit module, rank excellent
Junos OS: other exploited entries
| Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|
| CVE-2023-36844EX Series PHP External Variable Modification | Juniper Junos OS | Patch this weekEPSS 0.90 | 0.90 | ||
| CVE-2023-36846SRX Series Missing Authentication for Critical Function | Juniper Junos OS | Patch this weekEPSS 0.93 | 0.93 | ||
| CVE-2023-36847EX Series Missing Authentication for Critical Function | Juniper Junos OS | Patch this weekEPSS 0.83 | 0.83 | ||
| CVE-2020-1631Path Traversal | Juniper Junos OS | Patch soon | 0.05 | ||
| CVE-2025-21590Improper Isolation or Compartmentalization | Juniper Junos OS | Patch soon | 0.02 | ||
| CVE-2023-36851SRX Series Missing Authentication for Critical Function | Juniper Junos OS | Patch soon | 0.01 |
Read further
- CVE recordcve.org
- NVD entrynvd.nist.gov
- CISA's catalogcisa.gov
- EPSS for this CVEapi.first.org