CVE-2023-54405 in CVM
Summary
by MITRE • 10/02/2026
H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter without restricting path traversal or file type. Attackers can exploit the path traversal in the token parameter to upload a malicious JSP file into a web-accessible directory and then request it to achieve remote code execution as the web-server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The vulnerability identified in H3C CVM, specifically within the Cloud Virtualization Management component of the H3C CAS cloud platform, represents a critical security flaw rooted in improper input validation and access control mechanisms. This unauthenticated arbitrary file upload vulnerability resides in the /cas/fileUpload/upload endpoint, which is designed to handle file uploads for management purposes but fails to enforce strict restrictions on the types of files accepted or the paths into which they are written. The core technical failure lies in the manipulation of the caller-supplied token parameter, which serves as a mechanism for path resolution during the upload process. By exploiting this flaw, remote attackers can bypass intended security controls that should prevent writing outside of designated directories or restricting uploads to non-executable file types. This lack of sanitization allows for both arbitrary file write capabilities and directory traversal attacks, creating a direct pathway for malicious code injection into the server environment.
From an operational perspective, the exploitation of this vulnerability leads directly to remote code execution with the privileges of the web-server user. Attackers can craft requests that utilize path traversal sequences within the token parameter to navigate up the file system hierarchy or redirect the write operation into a web-accessible directory. Once inside such a directory, the attacker uploads a malicious JavaServer Page (JSP) file, which is an executable script format commonly processed by Apache Tomcat and similar servlet containers often used in these environments. Upon successful upload, simply requesting this JSP file triggers its execution on the server side. This results in the immediate compromise of the underlying operating system through the context of the web service account, granting the attacker full control over the affected component without requiring any prior authentication credentials.
The severity and impact of this vulnerability are further underscored by real-world exploitation evidence observed by the Shadowserver Foundation starting on October 14, 2023. This indicates that active campaigns targeting H3C CAS deployments are already underway in the wild, making timely remediation essential for organizations relying on this cloud platform infrastructure. The ability to achieve remote code execution without authentication classifies this as a high-severity issue under common vulnerability scoring systems due to its ease of exploitation and significant impact on confidentiality, integrity, and availability.
In terms of industry standard classifications, this flaw aligns with CWE-434, which describes the unrestricted upload of file with dangerous type, allowing attackers to execute arbitrary code if the server processes uploaded files as scripts. Additionally, it relates closely to CWE-22, specifically improper limitation of a pathname to a restricted directory, highlighting the failure in validating and restricting user-supplied input against path traversal attacks. From an offensive security perspective, this vulnerability maps directly to MITRE ATT&CK technique T1505.003, known as Web Shell: JSP Web Shell, which details how attackers install web shells for persistent access and lateral movement within compromised networks.
Mitigation strategies must focus on immediate patching of the H3C CAS platform to versions that address this specific endpoint vulnerability if available from the vendor. In cases where patches are not immediately deployable, network-level controls should be implemented to restrict access to the /cas/fileUpload/upload endpoint exclusively to trusted management IP addresses using firewall rules or web application firewalls. Furthermore, administrators should ensure that any exposed services run with minimal privileges and consider implementing strict file upload filters on the web server configuration level to block execution of JSP files in directories not explicitly intended for dynamic content generation. Regular monitoring for unusual outbound connections from these servers can also aid in early detection of exploitation attempts given the observed activity by threat actors like Shadowserver Foundation.