Full Report
Huntress has verified that attackers are exploiting flaws in Samsung MagicINFO 9 Server (version 21.1050.0). Understand why MagicINFO 9 Server shouldn’t be internet-facing until a patch is available and applied.
Analysis Summary
# Vulnerability: Samsung MagicINFO 9 Server Arbitrary File Upload and RCE
## CVE Details
* **CVE ID:** Unassigned/Pending (Referred to as the "Samsung MagicINFO 9 Server Flaw")
* **CVSS Score:** Estimated 9.8 - 10.0 (Critical)
* **CWE:** CWE-434 (Unrestricted Upload of File with Dangerous Type) / CWE-94 (Code Injection)
## Affected Systems
* **Products:** Samsung MagicINFO 9 Server (Content Management System for digital signage)
* **Versions:** 21.1050.0 (Latest) and 21.1040.2 (Verified)
* **Configurations:** Servers that are internet-facing or accessible via the public web.
## Vulnerability Description
The flaw allows an unauthenticated attacker to upload arbitrary files to the MagicINFO 9 Server. By leveraging this upload capability, attackers can bypass security controls to achieve Remote Code Execution (RCE). The vulnerability stems from insufficient validation of user-supplied files, allowing attackers to place malicious scripts (such as PHP or JSP shells) into directories where they can be executed by the web server.
## Exploitation
* **Status:** Exploited in the wild.
* **Complexity:** Low (Scripted attacks observed).
* **Attack Vector:** Network (Remote).
* **PoC Availability:** Publicly available (Released April 30, 2025).
## Impact
* **Confidentiality:** High (Full access to server data and potential lateral movement).
* **Integrity:** High (Unauthorized installation of services and modification of system binaries).
* **Availability:** High (Potential for system instability or ransomware deployment).
## Remediation
### Patches
* **Status:** At the time of the report, a specific patch for version 21.1050.0 was not explicitly confirmed as available. Users are advised to contact Samsung support for the latest security hotfix.
### Workarounds
* **Restrict Access:** Immediately remove MagicINFO 9 Servers from the public internet. Use a VPN or IP allow-listing for administrative access.
* **Network Segmentation:** Isolate the MagicINFO server from the rest of the corporate network to prevent lateral movement.
## Detection
### Indicators of Compromise
* **Suspicious Service Creation:** Windows Event ID 7045 showing new services using `php-cli.exe` or `php-fpm.exe` from unusual paths (e.g., `C:\MagicInfo Premium\tomcat\bin\`).
* **Binary Renaming:** Presence of `srvany.exe` renamed to `php-cli.exe`.
* **Unauthorized Reconnaissance:** Execution of commands such as `whoami` and `arp -a` originating from the web server process.
* **Service Failures:** Windows Event ID 7000 indicating the `PHP5.3.8` service failed to start (indicative of failed exploitation attempts).
### Detection Methods and Tools
* **EDR/SIEM Monitoring:** Monitor for `cmd.exe` or `powershell.exe` being spawned by `tomcat9.exe` or `java.exe` (the parent processes for MagicINFO).
* **Log Analysis:** Review MagicINFO application logs and Tomcat access logs for unusual POST requests to file upload endpoints.
## References
* Huntress Rapid Response: hxxps[://]www[.]huntress[.]com/blog/rapid-response-samsung-magicinfo9-server-flaw
* Huntress Analysis: hxxps[://]www[.]huntress[.]com/blog/post-exploitation-activities-observed-from-samsung-magicinfo-9-server-flaw
* PoC Verification: hxxps[://]x[.]com/CyberRaiju/status/1920012532615418154