Vulnerability record · CVE-2023-36851 · published 27 September 2023
CVE-2023-36851: Juniper Junos OS SRX J-Web missing authentication allows file upload/download
Juniper · Junos
Junos OS on SRX Series exposes webauth_operation.php without authentication, letting a network attacker upload and download arbitrary files through J-Web. The flaw is a missing authentication check on a critical function, so it undermines file system integrity and confidentiality and can be chained with other issues. It affects multiple Junos OS release trains before their listed fixed builds.
Description
A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of integrity or confidentiality, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on SRX Series: * 21.2 versions prior to 21.2R3-S8; * 21.4 versions prior to 21.4R3-S6; * 22.1 versions prior to 22.1R3-S5; * 22.2 versions prior to 22.2R3-S3; * 22.3 versions prior to 22.3R3-S2; * 22.4 versions prior to 22,4R2-S2, 22.4R3; * 23.2 versions prior to 23.2R1-S2, 23.2R2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Automated analysis
high priorityThe flaw is unauthenticated and network-reachable and is listed in CISA KEV as exploited, though the direct CVSS impact is limited to low integrity loss.
What it is
Junos OS on SRX Series exposes webauth_operation.php without authentication, letting a network attacker upload and download arbitrary files through J-Web. The flaw is a missing authentication check on a critical function, so it undermines file system integrity and confidentiality and can be chained with other issues. It affects multiple Junos OS release trains before their listed fixed builds.
Impact
An unauthenticated attacker gains the ability to read and write arbitrary files via J-Web, causing loss of confidentiality and integrity. That access can serve as a stepping stone for chaining into further compromise.
Attack surface
Reachable over the network through the J-Web interface by sending a crafted request to webauth_operation.php; no authentication and no user interaction are required per the CVSS vector.
Exploitation
CISA added this to the Known Exploited Vulnerabilities catalog on 2023-11-13 with a 2023-11-17 remediation due date, indicating known exploitation; EPSS 30-day probability is about 1.1 percent (64.6th percentile). No ransomware campaign use is recorded.
What to do
- Upgrade Junos OS on SRX Series to a fixed release: 21.2R3-S8, 21.4R3-S6, 22.1R3-S5, 22.2R3-S3, 22.3R3-S2, 22.4R2-S2 or 22.4R3, or 23.2R1-S2 or 23.2R2, per Juniper advisory JSA72300.
- If immediate upgrade is not possible, disable or restrict J-Web access and apply the mitigations in the vendor advisory.
- Limit J-Web exposure to trusted management networks and block it from untrusted interfaces.
- Follow CISA KEV required action: apply vendor mitigations or discontinue use of the product if mitigations are unavailable.
Detection
- Monitor J-Web access logs for requests to webauth_operation.php, especially from unexpected or external source addresses.
- Alert on file upload or download activity through J-Web outside normal administrative patterns.
- Review SRX devices for unexpected files or configuration changes that could indicate chaining attempts.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2023-36851 to the Known Exploited Vulnerabilities catalog on 13 November 2023 as "Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 17 November 2023.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://supportportal.juniper.net/JSA72300 | Vendor Advisory |
| https://supportportal.juniper.net/JSA72300 | Vendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36851 | US Government Resource |
Track CVE-2023-36851 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-36851), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
