Detect Samsung MagicINFO 9 Server Path Traversal and Arbitrary File Upload in Microsoft Sentinel
Detects exploitation of CVE-2024-7399, a path traversal and unrestricted file upload vulnerability in Samsung MagicINFO 9 Server. Successful exploitation allows unauthenticated or low-privileged attackers to upload arbitrary files outside the intended directory, potentially leading to remote code execution. This CVE is actively exploited in the wild (CISA KEV).
MITRE ATT&CK
- Tactic
- Initial Access Execution Persistence
KQL Detection Query
let MagicINFOPorts = dynamic([80, 443, 8080, 7001, 8088]);
let SuspiciousExtensions = dynamic(['.jsp', '.aspx', '.php', '.war', '.jspx', '.ashx', '.sh', '.py', '.pl']);
let TraversalPatterns = dynamic(['../', '..\\', '%2e%2e%2f', '%2e%2e/', '..%2f', '%2e%2e%5c']);
union DeviceNetworkEvents, CommonSecurityLog
| where TimeGenerated > ago(24h)
| where DestinationPort has_any (MagicINFOPorts)
or RequestURL has_any (TraversalPatterns)
or RequestURL has_any (SuspiciousExtensions)
| where RequestURL contains 'MagicInfo' or DestinationHostName contains 'magicinfo'
or RequestURL has_any (TraversalPatterns)
| extend CleanURL = tolower(RequestURL)
| where CleanURL has_any (TraversalPatterns) or CleanURL has_any (SuspiciousExtensions)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, RequestURL, RequestMethod, ResponseCode, DeviceAction
| summarize Attempts=count(), Methods=make_set(RequestMethod), URLs=make_set(RequestURL, 10) by SourceIP, DestinationIP, bin(TimeGenerated, 5m)
| where Attempts > 2
| extend AlertSeverity = 'High', CVE = 'CVE-2024-7399'Detects HTTP requests to Samsung MagicINFO 9 Server endpoints containing path traversal sequences or suspicious file extensions indicative of CVE-2024-7399 exploitation attempts.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate administrative file uploads to MagicINFO server using paths that contain dots
- Security scanners or vulnerability assessment tools performing authorized scans of MagicINFO endpoints
- URL-encoded characters in normal content delivery requests to MagicINFO server
Other platforms for CVE-2024-7399
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2024-7399 Path Traversal Directory Enumeration
Expected signal: Web access logs show GET requests with '../', '%2e%2e%2f', or '..%2f' in the URI path targeting MagicINFO endpoints. Network monitoring captures HTTP requests to port 8080 with traversal sequences.
- Test 2CVE-2024-7399 Web Shell Upload via Path Traversal
Expected signal: IIS or servlet container logs show POST request to upload endpoint with path traversal in query parameter. Filesystem monitoring detects new .jsp file created in webroot. Process monitoring may show java.exe or tomcat process writing to unexpected directory.
- Test 3CVE-2024-7399 Web Shell Execution Verification
Expected signal: Access logs show GET request to the uploaded shell path returning HTTP 200. EDR/process monitoring captures cmd.exe, sh, or powershell.exe spawned as a child of the Java/Tomcat process. Network connections from MagicINFO server process to external IPs if a reverse shell payload is used.
Response Playbook
Triage
- Identify the source IP and determine if it is internal, external, or a known security scanner. Check threat intelligence feeds for reputation of the source IP.
- Review the full request URL and HTTP method to confirm the presence of path traversal sequences (e.g., '../', '%2e%2e%2f') or suspicious file extensions (.jsp, .aspx, .php, .war) in POST requests to MagicINFO endpoints.
- Check the HTTP response code: a 200 or 201 response to a POST with a traversal path strongly indicates successful exploitation. A 400 or 403 may indicate a failed or blocked attempt.
- Correlate with endpoint telemetry on the MagicINFO server host to identify any new files created in unexpected directories (e.g., webroot, tmp, upload paths outside intended scope).
- Determine whether the MagicINFO 9 Server version is patched. Samsung has issued a security update — confirm the installed version against the advisory at https://security.samsungtv.com/securityUpdates.
Containment
- If exploitation is confirmed (successful file upload or path traversal to sensitive directories), immediately isolate the MagicINFO 9 Server from the network by blocking inbound connections at the perimeter firewall or load balancer, while preserving the host for forensics.
- Block the attacker source IP(s) at the perimeter firewall and WAF. Apply rate limiting and path traversal filtering rules to the MagicINFO application endpoint as an interim mitigation if patching cannot be performed immediately.
Evidence Collection
- Collect and preserve IIS or application server access logs from the MagicINFO server covering at least 72 hours prior to detection, including full URI, method, source IP, user-agent, and response code fields.
- Enumerate files in the MagicINFO upload and webroot directories, noting any files with unexpected extensions (.jsp, .php, .aspx, .sh) or recent modification timestamps that correlate with the attack window.
Escalation Criteria
- !Escalate immediately to incident response if a successful file upload is confirmed, especially if the uploaded file has an executable extension (.jsp, .aspx, .php) or if any process execution is detected originating from the MagicINFO server process.
- !Escalate if lateral movement is detected from the MagicINFO server to other internal systems, or if new administrative accounts or scheduled tasks are observed on the host following the exploitation window.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
IIS or servlet container access logs showing POST requests with '../', '%2e%2e%2f', or similar patterns in the URI targeting MagicINFO upload endpoints - >
Filesystem artifacts: newly created files in MagicINFO webroot or upload directories with executable extensions (.jsp, .jspx, .aspx, .php) and recent creation timestamps - >
Windows Event Logs (Security, Application) showing unexpected child process execution spawned by the MagicINFO server process (e.g., cmd.exe, powershell.exe, wscript.exe as children of java.exe or tomcat process)
Tuning Guidance
Reduce false positives by building an allowlist of known authorized scanner IPs and MagicINFO integration service accounts, and excluding these from threshold-based rules. If MagicINFO is only accessible from specific IP ranges, add a source IP filter to limit detections to unexpected source networks. Increase confidence to 'high' if the target host is confirmed to be running Samsung MagicINFO 9 Server by correlating with asset inventory. Consider lowering the attempt threshold from 2 to 1 for POST requests uploading .jsp/.war files, as even a single successful upload is high-severity. Monitor for HTTP 200 responses specifically, as successful exploitation will return a success code.
Hunting Queries
Broader 7-day hunt across IIS/web logs for all path traversal sequences and suspicious POST-based file upload patterns that may indicate CVE-2024-7399 exploitation or reconnaissance, including any attempts that did not trigger threshold-based detections.
W3CIISLog
| where TimeGenerated > ago(7d)
| where csUriStem has_any ('../', '..\\', '%2e%2e', '%2e%2e%2f', '..%2f')
or (csMethod == 'POST' and csUriStem matches regex @'(?i)\.(jsp|jspx|aspx|php|war|sh)$')
| project TimeGenerated, cIP, csMethod, csUriStem, scStatus, csUserAgent
| order by TimeGenerated descindex=iis OR index=web sourcetype=ms:iis:auto
| eval uri_lower=lower(cs_uri_stem)
| where match(uri_lower, "\.\./|%2e%2e%2f|%2e%2e/|\.\.%2f|%2e%2e%5c")
OR (cs_method="POST" AND match(uri_lower, "\.(jsp|jspx|aspx|php|war|sh)($|\?)"))
| stats count by c_ip, cs_method, cs_uri_stem, sc_status
| sort - countAtomic Red Team Tests
Simulates an attacker using path traversal sequences in HTTP GET requests to enumerate directories outside the MagicINFO intended upload path. Lab use only.
Command
curl -v -k 'http://TARGET_IP:8080/MagicInfo/../../etc/passwd' -H 'User-Agent: Mozilla/5.0'
curl -v -k 'http://TARGET_IP:8080/MagicInfo/%2e%2e%2f%2e%2e%2fetc%2fpasswd' -H 'User-Agent: Mozilla/5.0'
curl -v -k 'http://TARGET_IP:8080/MagicInfo/..%2f..%2fWindows/win.ini' -H 'User-Agent: Mozilla/5.0'Cleanup
No cleanup required — read-only traversal attempts do not create artifacts on the target.Expected Telemetry
Web access logs show GET requests with '../', '%2e%2e%2f', or '..%2f' in the URI path targeting MagicINFO endpoints. Network monitoring captures HTTP requests to port 8080 with traversal sequences.
Expected Detection
Rule triggers on path traversal sequences in URI targeting MagicINFO server port. Analyst should observe source IP, URI pattern, and HTTP response code in alert details.
Simulates attacker uploading a JSP web shell to the MagicINFO server webroot via a multipart POST request exploiting the unrestricted file upload vulnerability combined with path traversal. Lab use only — isolated environment required.
Command
curl -v -k -X POST 'http://TARGET_IP:8080/MagicInfo/upload?path=../../webapps/ROOT/' \
-H 'Content-Type: multipart/form-data' \
-F 'file=@/tmp/test.jsp;type=text/plain' \
-H 'User-Agent: Mozilla/5.0'
# Create test payload: echo '<% out.println("CVE-2024-7399-TEST"); %>' > /tmp/test.jspCleanup
rm /tmp/test.jsp; If upload succeeded in lab, remove the dropped file from the target webroot: rm TARGET_WEBROOT/test.jspExpected Telemetry
IIS or servlet container logs show POST request to upload endpoint with path traversal in query parameter. Filesystem monitoring detects new .jsp file created in webroot. Process monitoring may show java.exe or tomcat process writing to unexpected directory.
Expected Detection
Rule triggers on POST request with traversal pattern and .jsp extension. Filesystem integrity monitoring (if deployed) alerts on new executable file in webroot. EDR process creation alert if web shell is subsequently accessed.
After simulating a successful web shell upload in a lab, verifies execution by sending an HTTP request to the dropped shell and observing command output. Confirms full exploitation chain for detection validation.
Command
# Assumes test.jsp was uploaded in previous atomic test
curl -v -k 'http://TARGET_IP:8080/test.jsp' -H 'User-Agent: Mozilla/5.0'
# For a command-executing test shell in lab: curl -k 'http://TARGET_IP:8080/cmd.jsp?cmd=whoami'Cleanup
Remove any web shells deployed during testing: rm TARGET_WEBROOT/test.jsp TARGET_WEBROOT/cmd.jsp. Restart MagicINFO service to clear any in-memory session state from testing.Expected Telemetry
Access logs show GET request to the uploaded shell path returning HTTP 200. EDR/process monitoring captures cmd.exe, sh, or powershell.exe spawned as a child of the Java/Tomcat process. Network connections from MagicINFO server process to external IPs if a reverse shell payload is used.
Expected Detection
T1505.003 web shell detection should trigger on process creation from web server parent process. Network detection rules should alert on outbound connection from MagicINFO server to unexpected external IP. Alert correlation should link initial upload event (Atomic Test 2) with shell execution event.