对受限目录路径限制不当 ('Path Traversal') 漏洞，Samsung Electronics MagicINFO 9 Server 允许上传 Web Shell 到 Web 服务器。此问题影响 Magi

The Path Traversal vulnerability in MagicINFO 9 Server presents a severe risk. Successful exploitation allows an attacker to bypass access controls and upload arbitrary files, specifically web shells. These web shells can then be used to execute arbitrary code on the server, leading to complete system compromise. An attacker could gain full control over the MagicINFO 9 Server, potentially accessing sensitive data, modifying configurations, and launching further attacks against other systems on the network. The blast radius extends to any data or services accessible through the compromised server, and the ability to execute code opens the door to persistent backdoors and lateral movement within the network.

Organizations utilizing Samsung MagicINFO 9 Server, particularly those with internet-facing deployments or those lacking robust access controls, are at significant risk. Shared hosting environments where multiple users share the same server instance are also vulnerable, as a compromise of one user's MagicINFO 9 Server could potentially impact others.

• other / server:

# Monitor MagicINFO 9 Server logs for unusual file uploads or access attempts
grep -i 'upload' /var/log/magicinfo/server.log

• other / server:

# Check for the presence of suspicious web shell files (e.g., .php, .jsp) in upload directories
find /opt/magicinfo/uploads -name '*.php' -o -name '*.jsp'

1. 2025-07-23Disclosure

   disclosure

1. 已保留2025-07-22
2. 发布日期2025-07-23
3. 修改日期2026-02-26
4. EPSS 更新日期2026-03-23

While a patch from Samsung is the definitive solution, several mitigations can reduce the risk until the upgrade is possible. First, strictly restrict file upload functionality within MagicINFO 9 Server, limiting allowed file types and sizes. Implement robust input validation to prevent path manipulation attempts. Consider deploying a Web Application Firewall (WAF) to filter malicious requests and block attempts to upload web shells. Regularly monitor server logs for suspicious activity, such as unusual file uploads or unexpected code execution. After applying mitigations, verify their effectiveness by attempting to upload a test file with a manipulated path.