Critical Authentication Bypass in Juniper Junos OS SRX Series (CVE‑2023‑36851) Enables Unauthorized File Upload
What It Is – A missing authentication check in the webauth_operation.php endpoint of Juniper Junos OS on SRX Series devices allows an unauthenticated network‑connected attacker to upload arbitrary files via J‑Web. The flaw compromises file‑system integrity and can be leveraged to chain additional attacks.
Exploitability – The vulnerability is publicly disclosed (CVE‑2023‑36851) and a proof‑of‑concept request has been published. No public exploit kit is known, but the attack requires only network access to the management interface. CVSS v3.1 base score is 7.5 (High).
Affected Products – Juniper Networks Junos OS running on SRX Series firewalls and routers (all supported releases prior to the vendor’s September 2023 patch).
Why It Matters for Trust & Control Assurance
- Demonstrates a gap in access‑control enforcement for privileged web functions – a core control objective that underpins many frameworks (e.g., NIST CSF 2.0 PR.AC‑01).
- Without proper authentication, continuous monitoring cannot reliably flag unauthorized changes, weakening the audit trail that regulators and customers demand.
- Evidence of remediation (patch status, configuration baselines) becomes essential to prove due‑diligence during third‑party assessments.
Recommended Actions
- Apply Juniper’s September 2023 security patch for CVE‑2023‑36851 immediately.
- Restrict J‑Web access to trusted management networks and enforce multi‑factor authentication on all administrative interfaces.
- Enable file‑integrity monitoring and log all J‑Web requests; retain logs for at least 90 days for auditability.
- Validate existing configurations against the “authentication for critical functions” control objective and document compliance evidence.
Source: CISA KEV – CVE‑2023‑36851