Other nomination

Fileless Remote Code Execution on Juniper Firewalls

A single environment-variable manipulation flaw in Juniper SRX and EX J-Web devices is turned into unauthenticated remote code execution that writes nothing to disk: PHP is made to read its configuration from the CGI process's own standard input, so the HTTP request body supplies both the config and, via an inline data URL, the attacker's code. It also leaks arbitrary files.

Record

Published by

VulnCheck

In the archive

• Nominated for the 2023 Top 10 Web Hacking Techniques

Related sources

• Research scanner

Tags

• rce
• php
• info-leak
• cve
• attack-chain
• http
• tooling
• large-scale-scan

This page is the archive's own catalogue record. The research is the work of VulnCheck, first published at the original source. Preserved copies are kept so the citation survives its host.