Exploit released for Juniper firewall bugs allowing RCE attacks
Proof-of-concept exploit code has been publicly released for vulnerabilities in Juniper SRX firewalls that, when chained, can allow unauthenticated attackers to gain remote code execution in Juniper's JunOS on unpatched devices. Juniper disclosed four medium-severity bugs in its EX switches and SRX firewalls and released security patches two weeks ago. The security flaws were found in the PHP-based J-Web interface that admins can use to manage and configure Juniper devices on their networks. WatchTowr Labs security researchers have since developed and released a proof-of-concept (PoC) exploit that chains the SRX firewall flaws, a missing authentication for critical function vulnerability (CVE-2023-36846) and a PHP external variable modification bug (CVE-2023-36845). Admins are urged to apply Juniper's patches or upgrade JunOS to the latest release or, at least, apply the mitigation measures suggested by the vendor as soon as possible. CVEs: CVE-2023-36844, CVE-2023-36847, CVE-2023-36846, CVE-2023-36845 [View Article](https://www.bleepingcomputer.com/news/security/exploit-released-for-juniper-firewall-bugs-allowing-rce-attacks/)