| Titolo | H3C Magic NX15 NX15V100R017 Path Traversal |
|---|
| Descrizione | A vulnerability was found in H3C Magic NX15 NX15V100R017. The affected element is the function importprofile of the file /api/upload. The manipulation of the argument fileName leads to a path traversal, resulting in an arbitrary file write as root. It is possible to initiate the attack remotely. An authentication is required to exploit this vulnerability. The exploit has been disclosed to the public and may be used.
Technical detail:
The importprofile method of the esps.system ubus object, reachable through /api/upload?type=cfg, extracts an attacker-supplied tar archive with the command "cd / && tar -xzvf /tmp/NX15.tar.gz", so archive member names resolve against the root filesystem and are not sanitised. The container is validated only by a product/version string and an MD5 checksum stored in NX15.info, both of which the attacker supplies; the version comparison is a "not newer than" test that the running revision 017 satisfies trivially. The obfuscation applied to the upload is a single-byte XOR with 0x55, which is the entirety of /usr/bin/file_encrypt. Verified on the device by writing the string XGCTF{} to /www/download/flag.txt and retrieving it over HTTP. Note that the method additionally executes "rm -rvf /mnt/config/*", which destroys the persistent configuration layer; if the subsequent configuration commit succeeds the device reboots into the factory setup-wizard state, in which /api/wizard/config is reachable without authentication.
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), CWE-73 (External Control of File Name or Path).
CVSS 3.1: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2). |
|---|
| Fonte | ⚠️ https://github.com/XxingGoD/H3C-NX15-R017-Vulns/tree/main/H3C/NX15R017/importprofile_arbitrary_file_write |
|---|
| Utente | starlight (UID 101288) |
|---|
| Sottomissione | 16/09/2026 09:47 (1 mese fa) |
|---|
| Moderazione | 19/10/2026 17:59 (1 month later) |
|---|
| Stato | Accettato |
|---|
| Voce VulDB | 422420 [H3C Magic NX15 V100R017 /api/upload importprofile fileName directory traversal] |
|---|
| Punti | 20 |
|---|