Exploitation active confirmée

Ajoutée au catalogue CISA KEV le 13/11/2023, correctif exigé avant le 17/11/2023 pour les agences fédérales américaines.

Action requise : Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description officielle (NVD)

Juniper Junos OS on EX Series and SRX Series contains a PHP external variable modification vulnerability that allows an unauthenticated, network-based attacker to control an important environment variable. Using a crafted request, which sets the variable PHPRC, an attacker is able to modify the PHP execution environment allowing the injection und execution of code.

Preuves de concept publiques (17)

Dépôts tiers non vérifiés, parfois piégés. Ne les exécutez jamais en production : uniquement dans un environnement de test isolé.

vulncheck-oss/cve-2023-36845-scanner · ★ 62 · 16/09/2023
A go-exploit to scan for Juniper firewalls vulnerable to CVE-2023-36845
kljunowsky/CVE-2023-36845 · ★ 55 · 26/09/2023
Juniper Firewalls CVE-2023-36845 - RCE
Asbawy/Automation-for-Juniper-cve-2023-36845 · ★ 19 · 29/01/2024
Simple Automation script for juniper cve-2023-36845
ak1t4/CVE-2023-36845 · ★ 5 · 13/02/2024
CVES
zaenhaxor/CVE-2023-36845 · ★ 4 · 29/09/2023
CVE-2023-36845 - Juniper Firewall Remote code execution (RCE)
cyberh3als/CVE-2023-36845-POC · ★ 4 · 02/10/2023
CVE-2023-36845 PoC script automates the PoC for CVE-2023-36845 targeting Juniper Networks Junos OS's J-Web component on EX and SRX Series devices. It exploits a PHP flaw, allowing remote modification
halencarjunior/CVE-2023-36845 · ★ 1 · 27/09/2023
simrotion13/CVE-2023-36845 · ★ 1 · 01/10/2023
jahithoque/Juniper-CVE-2023-36845-Mass-Hunting · ★ 1 · 30/01/2024
Juniper RCE (Remote Code Execution) CVE-2023-36845 is a vulnerability that has been identified within Juniper's software. This particular flaw allows for remote code execution, meaning an attacker cou
0xNehru/CVE-2023-36845-Juniper-Vulnerability · ★ 1 · 14/02/2024
This Python script automates the Proof of Concept (PoC) for CVE-2023-36845, a vulnerability impacting Juniper Networks Junos OS on EX and SRX Series devices. The vulnerability resides in the J-Web com