CVE-2023-36845: Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability

CVE-2023-36845 is a PHP external variable modification flaw in Juniper Junos OS on EX Series and SRX Series devices. An unauthenticated attacker on the network can send a crafted request that sets the PHPRC environment variable, altering the PHP execution environment and enabling code injection and execution. This matters because these platforms commonly sit at network edges and in security-critical roles; successful abuse can give an attacker a foothold without credentials.

Defenders should treat the issue as high priority until they confirm their devices are not exposed or have been updated per the vendor advisory. Specifics such as exact fixed releases must be verified against that advisory.

How it works

The weakness is classified as CWE-473 (External Variable Modification). In the affected Junos OS components that use PHP, an attacker can influence an important environment variable—PHPRC—through a specially crafted network request. Controlling PHPRC lets the attacker change how the PHP runtime is configured, which in turn permits injection and execution of attacker-supplied code. No authentication is required, and the attack is network-based. Public detail stops at this high-level description; the precise request format and any additional prerequisites must be confirmed against the vendor advisory rather than assumed.

Am I affected? How to find it in your systems

The vulnerability affects Juniper Junos OS running on EX Series switches and SRX Series firewalls. These devices are typically deployed as access or aggregation switches, campus edge switches, or perimeter and branch firewalls. Inventory every Juniper EX and SRX appliance in your environment, including those managed by partners or sitting in lab/DMZ segments.

• Query device inventory systems, configuration management databases, or Juniper management platforms for EX and SRX models running Junos OS.
• On each device, check the installed Junos version and any enabled PHP-related services or web management interfaces; compare against the versions and configurations listed in the vendor advisory.
• Look for unexpected external access to management or web interfaces that process PHP; restrict such access where possible.
• Review logs and telemetry for anomalous HTTP or management-plane requests that set environment variables or that coincide with unexplained process activity, new files, or outbound connections from the device. Absence of clear signatures does not prove safety—confirm patch status.

If you cannot determine the exact software train, treat the device as potentially affected until the vendor advisory is checked.

How to remediate

Patch first. Apply the vendor-supplied update for Junos OS on EX Series and SRX Series devices exactly as described in the official advisory. After installation, verify the new version is running and that any temporary work-arounds have been removed if the advisory so instructs.

• Follow the CISA-required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
• Once patched, re-validate that management interfaces are reachable only from authorized networks and that unnecessary PHP or web services are disabled.
• Harden the broader class of issues by ensuring environment variables and configuration paths used by scripting engines cannot be influenced by untrusted input, and by keeping management-plane services behind strong authentication and network controls.

Document the change window and retain evidence of the applied fix for audit purposes.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls.

• Segment the devices so that management and any PHP-enabled interfaces are reachable only from a tightly controlled jump-host or out-of-band network; block general internet or untrusted LAN access.
• If a web application firewall or reverse proxy sits in front of the management interface, apply virtual-patching rules that drop requests attempting to set PHPRC or other environment variables—test carefully so legitimate traffic is not broken.
• Disable any non-essential web or PHP-related features on the EX or SRX if the operational impact is acceptable and the vendor documentation permits it.
• Increase monitoring: alert on configuration changes, new processes, unexpected file writes, and anomalous outbound connections originating from the device. Capture full packet data for the management plane if feasible so post-incident analysis is possible.

These steps lower risk but do not replace the official patch; schedule the update as soon as operationally possible.

If your data may have been exposed

Actively exploited vulnerabilities of this class can lead to device compromise and subsequent lateral movement or data theft. Known ransomware use of CVE-2023-36845 is not documented, yet any successful code execution still warrants investigation of the affected devices and connected systems. Review logs for signs of follow-on activity, rotate credentials that may have been accessible from the device, and consider a free exposure scan of organizational email addresses against known breach data sets to identify whether related accounts appear in public dumps. Confirm all findings against the vendor advisory and your own forensic evidence before declaring the incident closed.