Juniper Junos OS EX Series J-Web PHP External Variable Modification Vulnerability (CVE-2023-36844) Security Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-36844) is a PHP External Variable Modification vulnerability (CWE-473) residing in the J-Web management interface of Juniper Networks Junos OS on EX Series switches. Due to insufficient input validation and insecure PHP configuration handling within J-Web, an unauthenticated, network-based attacker can send crafted HTTP requests to modify critical PHP environment variables (such as PHPRC or PHP_ADMIN_VALUE).

2. Exploitation Mechanics & Attack Scenario

An attacker sends a malicious HTTP POST request to the J-Web server containing parameters designed to override environment variables. By manipulating the 'PHPRC' variable, the attacker can force PHP to load a custom 'php.ini' configuration file from an arbitrary location (e.g., '/tmp' or an external share). This allows the attacker to alter runtime behaviors, such as enabling file uploads or using 'auto_prepend_file' to execute arbitrary PHP code. While this vulnerability primarily causes a partial loss of integrity on its own, it is highly dangerous as it can be chained with other vulnerabilities to achieve full Remote Code Execution (RCE) without authentication.

3. Infrastructure & Business Impact

This vulnerability is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. If an attacker successfully compromises an EX Series switch, they can gain administrative control over network infrastructure, monitor internal traffic, alter VLAN configurations, and pivot deeper into the enterprise network, posing a severe threat to business continuity and data confidentiality.