Samsung MagicINFO 9 Server Path Traversal and Arbitrary File Write Vulnerability (CVE-2024-7399) Advisory

1. Apply Official Security Patch

Immediately upgrade your Samsung MagicINFO 9 Server to version 21.1050 or higher.

2. Temporary Mitigations (Pre-patch)

• Network Access Control (ACL): Restrict access to the MagicINFO server management console and API ports. Ensure they are not exposed to the public internet and are only accessible via trusted internal networks or VPNs.
• WAF (Web Application Firewall) Rules: Deploy rules to detect and block path traversal sequences (../, ..\) and unauthorized file upload attempts.

  # Example Snort Rule Concept
  alert tcp $EXTERNAL_NET any -> $HOME_NET $HTTP_PORTS (msg:"COTS Path Traversal Attempt"; flow:established,to_server; content:".."; http_uri; sid:1000001; rev:1;)

• Least Privilege Principle: Configure the MagicINFO service to run under a low-privileged service account rather than the default 'LocalSystem' account to limit the impact of a potential compromise.

CVE-2024-7399 is a critical vulnerability in Samsung MagicINFO 9 Server caused by improper limitation of a pathname to a restricted directory (Path Traversal, CWE-22) combined with arbitrary file upload (CWE-434).

An unauthenticated remote attacker can exploit this vulnerability by sending crafted HTTP requests to bypass directory restrictions and write arbitrary files anywhere on the target system. Because the MagicINFO service typically runs with high privileges, the file write operation is executed with 'SYSTEM' authority.

In active exploitation scenarios, threat actors leverage this flaw to drop web shells into web-accessible directories, achieving full Remote Code Execution (RCE). This vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active in-the-wild exploitation.