漏洞描述
Multiple cves in Juniper Network (CVE-2023-36844|CVE-2023-36845|CVE-2023-36846|CVE-2023-36847).A PHP External Variable Modification vulnerability in J-Web of Juniper Networks Junos OS on EX Series allows an unauthenticated, network-based attacker to control certain, important environments variables. Utilizing a crafted request an attacker is able to modify certain PHP environments variables leading to partial loss of integrity, which may allow chaining to other vulnerabilities.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
labs.watchtowr.comhttps://labs.watchtowr.com/cve-2023-36844-and-friends-rce-in-juniper-firewalls/↗github.comhttps://github.com/watchtowrlabs/juniper-rce_cve-2023-36844↗supportportal.juniper.nethttps://supportportal.juniper.net/JSA72300↗packetstormsecurity.comhttp://packetstormsecurity.com/files/174397/Juniper-JunOS-SRX-EX-Remote-Code-Execution.html↗packetstormsecurity.comhttp://packetstormsecurity.com/files/174865/Juniper-SRX-Firewall-EX-Switch-Remote-Code-Execution.html↗