NETGEAR ProSAFE 网络管理系统 UpLoadServlet 目录遍历远程代码执行漏洞

该漏洞允许经过身份验证的远程攻击者利用目录遍历漏洞在受影响的 NETGEAR ProSAFE 网络管理系统实例上执行任意代码。攻击者可以上传恶意文件，并利用系统权限执行这些文件，从而完全控制受影响的设备。这可能导致数据泄露、系统被破坏、恶意软件部署以及网络内部的横向移动。由于该漏洞需要身份验证，因此攻击者需要先获取有效的凭据才能利用它。如果攻击者成功控制了设备，他们可以访问网络中的其他资源，并进一步扩大攻击范围。

Organizations using NETGEAR ProSAFE Network Management System in environments with limited network segmentation are particularly at risk. Those with legacy configurations or weak authentication practices are also more vulnerable. Shared hosting environments where multiple users share the same ProSAFE device should be considered high-priority targets.

• linux / server: Monitor system logs (journalctl) for unusual file upload activity or errors related to the UpLoadServlet. Look for attempts to access files outside of the intended upload directory.

journalctl -u prosafe -f | grep -i "uploadservlet"

• generic web: Use curl or wget to test the upload endpoint with a path traversal payload (e.g., ../../../../etc/passwd). Examine the response headers and content for any signs of unauthorized file access.

curl -X POST -F "file=../../../../etc/passwd" http://<prosafe_ip>/uploadservlet

• netgear: Review the ProSAFE Network Management System configuration for any unusual or unauthorized user accounts. Check for suspicious scheduled tasks or processes that might be related to exploitation.

1. 2024-06-06Disclosure

   disclosure

1. 已保留2024-05-29
2. 发布日期2024-06-06
3. 修改日期2024-08-01
4. EPSS 更新日期2026-04-02

NETGEAR 建议用户尽快升级到已修复的版本。如果无法立即升级，可以考虑以下缓解措施：限制对网络管理系统的访问，仅允许授权用户访问。实施严格的身份验证和访问控制策略，以防止未经授权的访问。监控网络流量，检测可疑活动，例如异常的文件上传。配置防火墙规则，阻止对 UpLoadServlet 的未经授权的访问。在升级后，请验证漏洞是否已成功修复，例如通过尝试触发漏洞并确认其不再有效。