Juniper Junos OS on SRX webauth_operation.php missing authentication

Summaryinfo

A vulnerability, which was classified as critical, has been found in Juniper Junos OS on SRX. The affected element is an unknown function of the file webauth_operation.php. This manipulation causes missing authentication. This vulnerability is tracked as CVE-2023-36851. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Juniper Junos OS on SRX (Router Operating System) (affected version unknown) and classified as critical. Affected by this vulnerability is an unknown functionality of the file webauth_operation.php. The manipulation with an unknown input leads to a missing authentication vulnerability. The CWE definition for the vulnerability is CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. As an impact it is known to affect integrity. The summary by CVE is:

A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attacker to cause limited impact to the file system integrity. With a specific request to webauth_operation.php that doesn't require authentication, an attacker is able to upload and download arbitrary files via J-Web, leading to a loss of integrity or confidentiality, which may allow chaining to other vulnerabilities. This issue affects Juniper Networks Junos OS on SRX Series: * 21.2 versions prior to 21.2R3-S8; * 21.4 versions prior to 21.4R3-S6; * 22.1 versions prior to 22.1R3-S5; * 22.2 versions prior to 22.2R3-S3; * 22.3 versions prior to 22.3R3-S2; * 22.4 versions prior to 22,4R2-S2, 22.4R3; * 23.2 versions prior to 23.2R1-S2, 23.2R2.

The weakness was disclosed 09/27/2023 as JSA72300. It is possible to read the advisory at supportportal.juniper.net. This vulnerability is known as CVE-2023-36851 since 06/27/2023. Technical details and also a exploit are known.

It is declared as attacked. By approaching the search of inurl:webauth_operation.php it is possible to find vulnerable targets with Google Hacking. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 11/13/2023 with a due date of 11/17/2023:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Upgrading eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Juniper

Name

• Junos OS

License

• commercial

Website

• Vendor: https://www.juniper.net/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion