삼성 MagicINFO 9 Server 임의 파일 쓰기 및 원격 코드 실행(RCE) 취약점 보안 권고 (CVE-2025-4632)

# Nginx Configuration - Block Path Traversal Attempts
server {
    listen 80;
    server_name magicinfo.local;

    # Block directory traversal sequences in URI
    if ($request_uri ~* '(\.\./|\.\.\\)') {
        return 400 'Invalid Request';
    }

    location / {
        proxy_pass http://127.0.0.1:7001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

# PowerShell - Check MagicINFO Service Port and Search for Traversal Patterns in Logs
Write-Host 'Checking active MagicINFO listening ports...' -ForegroundColor Cyan
Get-NetTCPConnection | Where-Object { $_.LocalPort -in @(7001, 7002) } | Format-Table

Write-Host 'Searching for potential Path Traversal attempts in IIS/Tomcat logs...' -ForegroundColor Yellow
$LogPath = 'C:\Program Files\MagicINFO Server  omcat\logs\*'
if (Test-Path $LogPath) {
    Select-String -Path $LogPath -Pattern '\.\./|\.\.\\' | Select-Object -First 20
} else {
    Write-Host 'Default log path not found. Please check custom log directory.' -ForegroundColor Red
}