Juniper Networks Junos OS J-Web External Variable Modification Vulnerability (CVE-2023-36845) Remote Code Execution Analysis and Mitigation Guide

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-36845) is a PHP External Variable Modification vulnerability (CWE-473) residing in the J-Web component of Juniper Networks Junos OS. The root cause lies in the J-Web web server's failure to properly sanitize and restrict environment variables passed via HTTP requests. This allows an unauthenticated attacker to set the 'PHPRC' environment variable, which dictates the directory where PHP looks for its configuration file (php.ini).

2. Exploitation Mechanics & Attack Scenario

An attacker sends a specially crafted HTTP POST request to the J-Web interface (typically on port 80 or 443). By injecting the 'PHPRC' variable into the request, the attacker forces the PHP engine to load a malicious configuration file from an arbitrary location (such as a temporary directory or an uploaded file). Once the PHP engine parses this attacker-controlled configuration, it executes arbitrary PHP code or system commands with the privileges of the J-Web web server process, leading to remote code execution.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and its inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, this vulnerability poses an immediate threat to enterprise networks. Since SRX firewalls and EX switches serve as critical perimeter and core routing infrastructure, a successful compromise allows attackers to bypass security controls, perform lateral movement, intercept sensitive network traffic, and establish persistent backdoors within the internal network.