Juniper Junos OS SRX Series J-Web Unauthenticated Arbitrary File Upload Vulnerability (CVE-2023-36846) Technical Advisory

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2023-36846) exists in the J-Web interface of Juniper Networks Junos OS on SRX Series devices. The root cause is a Missing Authentication for Critical Function (CWE-306) within the user.php endpoint. Because the application fails to enforce proper authentication checks before processing requests to this script, an unauthenticated network-based attacker can directly interact with it to upload arbitrary files to the local file system.

2. Exploitation Mechanics & Attack Scenario

An attacker scans for SRX devices exposing J-Web ports (typically TCP 80 or 443) to the public internet. The attacker then sends a specially crafted HTTP POST request targeting the user.php endpoint without providing any valid session credentials or authentication headers. The request contains multipart/form-data payload representing the file to be uploaded. The vulnerable script processes this request and writes the file to a directory on the file system. While this vulnerability primarily impacts file system integrity, threat actors actively chain this with other vulnerabilities (such as PHP environment manipulation flaws like CVE-2023-36845) to execute arbitrary code with administrative privileges.

3. Infrastructure & Business Impact

This vulnerability is highly critical and is actively exploited in the wild, as confirmed by its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog. A compromise of a perimeter firewall or gateway device allows attackers to establish a persistent foothold within the enterprise network, leading to lateral movement, VPN credential theft, sensitive data exfiltration, and potential ransomware deployment.