CVE-2023-36846

CVE-2023-36846 is a significant software vulnerability discovered in Juniper's system, identified as a pre-authentication upload vulnerability. This flaw allows for the uploading of an arbitrary PHP file to a restricted directory with a randomized file name without requiring authentication. The vulnerability was exploited by security researchers at watchTowr Labs, who used it to compromise the system and highlight the potential risks associated with this flaw. The researchers focused on two specific vulnerabilities in Juniper during their investigation: CVE-2023-36846 and CVE-2023-36845. Both vulnerabilities were outlined in Juniper's security advisory, indicating the company's awareness of these flaws. CVE-2023-36846, in particular, posed a serious threat due to its ability to bypass standard authentication protocols, thereby enabling unauthorized access and potential system compromise. Following the discovery and exploitation of the vulnerabilities, watchTowr Labs developed and released a proof-of-concept (PoC) exploit that chains the SRX firewall flaws together. The PoC exploit, available at https://github.com/watchtowrlabs/juniper-rce_cve-2023-36844, demonstrates how the missing authentication for critical function vulnerability (CVE-2023-36846) and a PHP external variable modification bug (CVE-2023-36845) can be exploited in conjunction. This release underscores the severity of these vulnerabilities and emphasizes the urgent need for remediation measures.