Networking hardware company Juniper Networks has released an “out-of-cycle” security update to address multiple flaws in the J-Web component of Junos OS that could be combined to achieve remote code execution on susceptible installations.
The four vulnerabilities have a cumulative CVSS rating of 9.8, making them Critical in severity. They affect all versions of Junos OS on SRX and EX Series.
“By chaining exploitation of these vulnerabilities, an unauthenticated, network-based attacker may be able to remotely execute code on the devices,” the company said in an advisory released on August 17, 2023.
The J-Web interface allows users to configure, manage, and monitor Junos OS devices. A brief description of the flaws is as follows -
A threat actor could send a specially crafted request to modify certain PHP environment variables or upload arbitrary files via J-Web sans any authentication to successfully exploit the aforementioned issues.
The vulnerabilities have been addressed in the below versions -
Users are recommended to apply the necessary fixes to mitigate potential remote code execution threats. As a workaround, Juniper Networks is suggesting that users either disable J-Web or limit access to only trusted hosts.
Proof-of-concept (PoC) exploit code has been released for multiple security flaws in Juniper SRX firewalls that, when chained, can allow unauthenticated attackers to gain remote code execution on unpatched devices.
The PoC, published by watchTowr, combines CVE-2023-36846 and CVE-2023-36845 to upload a PHP file containing malicious shellcode and achieve code execution by injecting the PHPRC environment variable to point to a configuration file in order to load the booby-trapped PHP script.
“This is an interesting bug chain, utilizing two bugs that would be near-useless in isolation and combining them for a ‘world ending’ unauthenticated RCE,” the company said.
Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.