Security News > 2023 > September > Nearly 12,000 Juniper Firewalls Found Vulnerable to Recently Disclosed RCE Vulnerability

New research has found that close to 12,000 internet-exposed Juniper firewall devices are vulnerable to a recently disclosed remote code execution flaw.

VulnCheck, which discovered a new exploit for CVE-2023-36845, said it could be exploited by an "Unauthenticated and remote attacker to execute arbitrary code on Juniper firewalls without creating a file on the system."

A subsequent proof-of-concept exploit devised by watchTowr combined CVE-2023-36846 and CVE-2023-36845 to upload a PHP file containing malicious shellcode and achieve code execution.

Arbitrary code execution is then achieved by leveraging PHP's auto prepend file and allow url include options in conjunction with the data:// protocol wrapper.

"Anyone who has an unpatched Juniper firewall should examine it for signs of compromise."

Juniper has since disclosed that it's not aware of a successful exploit against its customers, but warned that it has detected exploitation attempts in the wild, making it imperative that users apply the necessary fixes to mitigate potential threats.

News URL

https://thehackernews.com/2023/09/over-12000-juniper-firewalls-found.html