Juniper Junos OS J-Web RCE Chain (CVE-2023-36844 to 36847): PHP Environment Injection

1. The Four-CVE Chain That Compromised Core Routers

In August 2023, Juniper Networks released out-of-band security advisories for four distinct vulnerabilities affecting the J-Web management interface in Junos OS on SRX firewalls and EX switch series: CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847. When combined, these vulnerabilities created a seamless, unauthenticated remote code execution chain with a CVSS score of 9.8.

2. CVE Metadata Overview

3. Technical Exploit Mechanics: The Environment Injection

The J-Web interface utilized PHP for administrative reporting. Attackers chained two distinct flaws:

1. Upload Malicious PHP Config: Attackers used the unauthenticated file upload flaw to place a custom php.ini configuration file containing auto_prepend_file = /tmp/shell.php into /var/tmp/.
2. Set PHPRC Environment Variable: Attackers invoked the environment variable modification endpoint to set PHPRC = /var/tmp/. When the web server executed subsequent PHP requests, it parsed the attacker's custom php.ini file, executing the PHP payload and granting instant root shell access on the firewall.

POST /webauth_operation.php HTTP/1.1
Host: router.enterprise.net
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary

------WebKitFormBoundary
Content-Disposition: form-data; name="file"; filename="ini"

auto_prepend_file="/tmp/shell.php"
------WebKitFormBoundary--

4. Remediation & Hardening Blueprint

1. Upgrade Junos OS to patched service releases (Junos OS 20.4R3-S9, 21.2R3-S7, 21.4R3-S5, 22.2R3-S3, 22.4R2-S2, 23.2R1-S1+).
2. Disable the J-Web user interface completely on WAN-facing interfaces:

   
   # In Junos CLI configuration
   delete system services web-management
   commit