制限されたディレクトリへのパス名の不適切な制限 ('Path Traversal') の脆弱性により、Samsung Electronics MagicINFO 9 ServerでWeb ShellをWebサーバーにアップロードできる問題。この問題はMagicINFOに影響を与えます。

The Path Traversal vulnerability in MagicINFO 9 Server presents a severe risk. Successful exploitation allows an attacker to bypass access controls and upload arbitrary files, specifically web shells. These web shells can then be used to execute arbitrary code on the server, leading to complete system compromise. An attacker could gain full control over the MagicINFO 9 Server, potentially accessing sensitive data, modifying configurations, and launching further attacks against other systems on the network. The blast radius extends to any data or services accessible through the compromised server, and the ability to execute code opens the door to persistent backdoors and lateral movement within the network.

Organizations utilizing Samsung MagicINFO 9 Server, particularly those with internet-facing deployments or those lacking robust access controls, are at significant risk. Shared hosting environments where multiple users share the same server instance are also vulnerable, as a compromise of one user's MagicINFO 9 Server could potentially impact others.

• other / server:

# Monitor MagicINFO 9 Server logs for unusual file uploads or access attempts
grep -i 'upload' /var/log/magicinfo/server.log

• other / server:

# Check for the presence of suspicious web shell files (e.g., .php, .jsp) in upload directories
find /opt/magicinfo/uploads -name '*.php' -o -name '*.jsp'

1. 2025-07-23Disclosure

   disclosure

1. 予約済み2025-07-22
2. 公開日2025-07-23
3. 更新日2026-02-26
4. EPSS 更新日2026-03-23

While a patch from Samsung is the definitive solution, several mitigations can reduce the risk until the upgrade is possible. First, strictly restrict file upload functionality within MagicINFO 9 Server, limiting allowed file types and sizes. Implement robust input validation to prevent path manipulation attempts. Consider deploying a Web Application Firewall (WAF) to filter malicious requests and block attempts to upload web shells. Regularly monitor server logs for suspicious activity, such as unusual file uploads or unexpected code execution. After applying mitigations, verify their effectiveness by attempting to upload a test file with a manipulated path.