CISA adds five vulnerabilities in Juniper devices to its Known Exploited Vulnerabilities catalog

US CISA added four vulnerabilities (tracked as CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, and CVE-2023-36847) in Juniper devices to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six new vulnerabilities to its Known Exploited Vulnerabilities catalog, five issues impacting Juniper Junos OS and one impacting the SysAid SysAid IT support software.

Below is the list of the added vulnerabilities:

• CVE-2023-47246 SysAid Server Path Traversal Vulnerability
• CVE-2023-36844 Juniper Junos OS EX Series PHP External Variable Modification Vulnerability
• CVE-2023-36845 Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability
• CVE-2023-36846 Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability
• CVE-2023-36847 Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability
• CVE-2023-36851 Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability

According to Juniper SIRT, the vulnerabilities in J-Web can be combined to allow an attacker to achieve preAuth Remote Code Execution. The vendor also confirmed that threat actors are chaining the issues in attacks in the wild.

“Juniper SIRT is now aware of successful exploitation of these vulnerabilities.  Customers are urged to immediately upgrade.” states the update published by the company on November 8^th 2023.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix these vulnerabilities by November 17, 2023, while the SysAid Server Path Traversal Vulnerability must be addressed by December 4, 2023.

Juniper addressed four medium-severity (CVSS 5.3) vulnerabilities (CVE-2023-36844, CVE-2023-36845, CVE-2023-36846, CVE-2023-36847) in In mid-August.

The vulnerabilities reside in the J-Web component of Juniper Networks Junos OS on SRX Series and EX Series.

“Multiple vulnerabilities in the J-Web component of Juniper Networks Junos OS on SRX Series and EX Series have been resolved through the application of specific fixes to address each vulnerability.” reads the advisory published by Juniper. “By chaining exploitation of these vulnerabilities, an unauthenticated, network-based attacker may be able to remotely execute code on the devices.”

“With a specific request that doesn’t require authentication an attacker is able to upload arbitrary files via J-Web, leading to a loss of integrity for a certain part of the file system, which may allow chaining to other vulnerabilities,” says Juniper.

The company also suggests disabling J-Web, or limiting access to only trusted hosts, as a workaround for this flaw.

At the end of August, watchTowr Labs security researchers published a proof-of-concept exploit (PoC) exploit code for vulnerabilities in Juniper SRX firewalls. An unauthenticated attacker can chain the vulnerabilities to gain remote code execution in Juniper JunOS on vulnerable devices.

watchTowr Labs security researchers exploited a pre-authentication upload vulnerability (CVE-2023-36846) to upload an arbitrary PHP file to a restricted directory with a randomised file name. Then they exploited the same vulnerable function to upload a PHP configuration file (.ini) which points to and loads the above PHP file using the auto_prepend_file directive.

As all environment variables can be set via HTTP requests, the researchers exploited the CVE-2023-36845 to overwrite the environment variable PHPRC and load the PHP configuration file and trigger the execution of the PHP file initially uploaded.

watchTowr also published a deep dive into reproducing, chaining and exploiting these vulnerabilities.

“This is an interesting bug chain, utilising two bugs that would be near-useless in isolation and combining them for a ‘world ending’ unauthenticated RCE.” explained the researchers.

“Given the simplicity of exploitation, and the privileged position that JunOS devices hold in a network, we would not be surprised to see large-scale exploitation.” continues the experts.

In Mid-September, VulnCheck researchers discovered approximately 12,000 internet-exposed Juniper SRX firewalls and EX switches that are vulnerable to the recently disclosed remote code execution flaw CVE-2023-36845.

VulnCheck developed a new exploit for the flaw CVE-2023-36845 that can be used by an unauthenticated and remote attacker to execute arbitrary code on Juniper firewalls without creating a file on the system.

Unlike the previous exploit, the one developed by VulnCheck can be written using a single cURL command and impacts older versions.

“The Juniper firewalls use the Appweb web server. When Appweb invokes a CGI script, it passes a variety of environment variables and arguments so that the script can access the user’s HTTP request. The body of the HTTP request is passed via stdin. The affected firewalls run FreeBSD, and every FreeBSD process can access their stdin by opening /dev/fd/0. By sending an HTTP request, we’re able to introduce a “file”, /dev/fd/0, to the system.” reads the analysis published by VulnCheck. “Using that trick, we can set the PHPRC environment variable to /dev/fd/0 and include the desired php.ini in our HTTP request.”

According to the cyber security firm, approximately 80% of affected internet-facing firewalls remain unpatched.

VulnCheck developed a vulnerability scanner to identify firewalls vulnerable to CVE-2023-36845. Using Shodan the experts discovered approximately 15,000 Juniper devices with internet-facing web interfaces.

“Firewalls are interesting targets to APT as they help bridge into the protected network and can serve as useful hosts for C2 infrastructure. Anyone who has an unpatched Juniper firewall should examine it for signs of compromise.” concludes the experts.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)