{"uuid": "ab7da6ad-be94-46cc-a32f-26997fb33f04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-36847", "type": "seen", "source": "https://t.me/hacking_Attack/119275", "content": "Black Hat Ethical Hacking\n12,000 Juniper Firewalls and Switches Vulnerable to Critical Flaw\n\n12,000 Juniper Firewalls and Switches Vulnerable to Critical Flaw\nPost Views: 35 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nAn estimated 12,000 Juniper SRX firewalls and EX switches are facing a severe vulnerability that could lead to remote code execution without authentication.\n\nIn August, Juniper disclosed a series of vulnerabilities, including \u2018PHP environment variant manipulation\u2019 (CVE-2023-36844/CVE-2023-36845) and \u2018Missing Authentication for Critical Function\u2019 (CVE-2023-36846/CVE-2023-36847). On their own, these vulnerabilities had a \u2018medium\u2019 severity rating of 5.3.\n\nHowever, when these vulnerabilities are chained together, they result in a critical remote code execution flaw with a rating of 9.8.\n\nWatchTowr Labs released a proof of concept (PoC) that exploited the CVE-2023-36845 and CVE-2023-36846 vulnerabilities. This PoC allowed researchers to execute code remotely by uploading two files to a vulnerable device.\n\nRecently, VulnCheck vulnerability researcher Jacob Baines presented another PoC exploit that only utilizes CVE-2023-36845. This bypasses the need to upload files while still achieving remote code execution.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nAs part of Baines\u2019 report, he shared a free scanner on GitHub designed to identify vulnerable deployments. The scanner revealed thousands of vulnerable devices exposed on the internet.\n\n\u201cIn this blog, we demonstrated how CVE-2023-36845, a vulnerability flagged as \u2018Medium\u2019 severity by Juniper, can be used to remotely execute arbitrary code without authentication,\u201d explains VulnCheck\u2019s report.\n\n\u201cWe\u2019ve turned a multi-step (but very good) exploit into an exploit that can be written using a single curl command and appears to affect more (older) systems.\u201d Exploit\n\nBaines conducted tests using an old Juniper SRX210 firewall but found that his device lacked the do_fileUpload() functionality necessary to upload files to the device. This disrupted watchTowr\u2019s exploit chain, prompting Baines to explore alternative methods for achieving remote code execution.\n\nBaines discovered that it was possible to bypass the need to upload files to the target servers by manipulating environment variables.\n\nThe Juniper firewall\u2019s Appweb web server processes user HTTP requests via stdin when running a CGI script. Attackers can manipulate this process to recognize a pseudo \u201cfile,\u201d/dev/fd/0, and adjust environment variables and HTTP requests to display sensitive data.\n\nVulnCheck leveraged PHP\u2019s \u2018auto_prepend_file\u2019 and \u2018allow_url_include\u2019 features to execute arbitrary PHP code using the data:// protocol without the need to upload any files.\n\nThe severity rating of CVE-2023-36845, originally 5.4, should now be re-evaluated as it has demonstrated the ability to achieve remote code execution without relying on other vulnerabilities.\n\nhttps://www.bleepstatic.com/images/news/u/1220909/2023/APTs/46/PoC.jpg Proof of concept curl command (VulnCheck)\nTrending: The Rise and Fall of Sabu: From Hacker Hero to FBI Informant Trending: Offensive Security Tool: Headerpwn\nThe impact of this security issue is more extensive and severe than its \u201cmedium\u201d CVSS rating indicates. Administrators should take immediate action to address this vulnerability.\n\nCVE-2023-36845 affects the following versions of Junos OS on EX Series and SRX Series:\n\n* All versions before 20.4R3-S8\n* 21.1 version 21.1R1 and later versions\n* 21.2 versions before 21.2R3-S6\n* 21.3 versions before 21.3R3-S5\n* 21.4 versions before 21.4R3-S5\n* 22.1 versions b[...]", "creation_timestamp": "2026-09-02T01:01:08.895420Z"}