# IOCs — CVE-2024-7399 (Samsung MagicINFO Path Traversal → RCE)
# Source: Lyrie lab reproduction + public disclosures
# Updated: 2026-04-25

[ http-request-signatures ]
POST /MagicInfo/servlet/SWUpdateFileUploader?filename=../shell.jsp
POST /MagicInfo/servlet/SWUpdateFileUploader?filename=..%2Fshell.jsp
POST /MagicInfo/servlet/SWUpdateFileUploader?filename=../../webapps/ROOT/shell.jsp
GET  /shell.jsp?cmd=whoami
GET  /shell.jsp?exec=id
GET  /*.jsp?cmd=*

[ behavioral-signatures ]
POST to SWUpdateFileUploader with `../` in filename → 200 OK
Followed by GET to uploaded `.jsp` file within 60s → 200 OK
JSP file accessed with query params like ?cmd= or ?exec= → process execution

[ file-paths ]
/webapps/ROOT/shell.jsp
/MagicInfo/shell.jsp
/shell.jsp
Any `.jsp` outside expected MagicINFO application directories

[ log-patterns ]
POST /MagicInfo/servlet/SWUpdateFileUploader?filename=../ → 200
GET /shell.jsp?cmd=* → 200
Same source IP performs both within < 5s (automation hallmark)

[ vulnerable-versions ]
Samsung MagicINFO 9 Server <= 21.1050

[ fixed-versions ]
Samsung MagicINFO 9 Server >= 21.1050

[ kev-listing ]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7399

[ associated-threat-actors ]
Mirai botnet variants (SANS ISC Diary 31920)
Generic webshell droppers targeting unpatched digital signage infrastructure

[ network-controls ]
Block external access to /MagicInfo/servlet/SWUpdateFileUploader
Restrict admin servlets to authenticated management IPs
Alert on any POST to SWUpdateFileUploader with `..` in query or body
Monitor filesystem for unexpected .jsp files under webapps/
