Summary
A critical code-injection vulnerability in the H3C Magic NX15 RPC interface affects the file-write function exposed through /api/esps.
A remote attacker who can reach the affected endpoint may manipulate the path argument and cause injected code to be processed by the device.
A critical code-injection vulnerability in the H3C Magic NX15 RPC interface affects the file-write function exposed through /api/esps.
A remote attacker who can reach the affected endpoint may manipulate the path argument and cause injected code to be processed by the device.
Affected context
The vulnerability occurs in H3C Magic NX15 devices running the affected NX15V100R017 software when the RPC interface exposes the /api/esps file-write functionality. Risk increases when the endpoint is remotely reachable and accepts insufficiently constrained path-related input before performing file operations or other processing.
The vulnerability occurs in H3C Magic NX15 devices running the affected NX15V100R017 software when the RPC interface exposes the /api/esps file-write functionality. Risk increases when the endpoint is remotely reachable and accepts insufficiently constrained path-related input before performing file operations or other processing.
Exploit preconditions
- Attack surface: Remote RPC interface
- Required access: Network reachability to the exposed
/api/espsendpoint; additional authentication requirements depend on device configuration - Trigger point: Processing of the
pathargument by the file-write function - Why exploitation is possible: The endpoint may interpret attacker-controlled path input in a way that permits code injection rather than treating it solely as inert file metadata
- Attack surface: Remote RPC interface
- Required access: Network reachability to the exposed
/api/espsendpoint; additional authentication requirements depend on device configuration - Trigger point: Processing of the
pathargument by the file-write function - Why exploitation is possible: The endpoint may interpret attacker-controlled path input in a way that permits code injection rather than treating it solely as inert file metadata
Why this happens
The underlying issue is improper handling of attacker-controlled input in a file-writing RPC operation. When path data is incorporated into downstream commands, interpreters, or executable processing without strict separation and validation, specially crafted input may alter program behavior.
This maps primarily to CWE-94: Improper Control of Generation of Code ('Code Injection') and is also related to CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection').
The underlying issue is improper handling of attacker-controlled input in a file-writing RPC operation. When path data is incorporated into downstream commands, interpreters, or executable processing without strict separation and validation, specially crafted input may alter program behavior.
This maps primarily to CWE-94: Improper Control of Generation of Code ('Code Injection') and is also related to CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection').
Potential impact
- An attacker may execute unauthorized code on the affected device
- Device configuration, files, or services could be modified
- Network traffic or administrative data could be exposed
- The device could be used for lateral movement or disruption
- Compromise could affect other systems reachable from the device
- An attacker may execute unauthorized code on the affected device
- Device configuration, files, or services could be modified
- Network traffic or administrative data could be exposed
- The device could be used for lateral movement or disruption
- Compromise could affect other systems reachable from the device
General mitigation guidance
Mitigation generally focuses on ensuring that file-operation inputs remain data and cannot become executable instructions.
Common defensive patterns include:
- Use dedicated file APIs instead of shell commands or interpreter evaluation
- Apply strict allowlist validation to path formats, permitted directories, and filenames
- Canonicalize paths and enforce confinement within an intended directory
- Separate user-controlled values from command or code construction
- Apply authentication and authorization checks consistently to RPC operations
- Run device services with the minimum privileges needed for file access
- Restrict network exposure of management and RPC interfaces
- Log rejected inputs and unusual file-write activity for investigation
Mitigation generally focuses on ensuring that file-operation inputs remain data and cannot become executable instructions.
Common defensive patterns include:
- Use dedicated file APIs instead of shell commands or interpreter evaluation
- Apply strict allowlist validation to path formats, permitted directories, and filenames
- Canonicalize paths and enforce confinement within an intended directory
- Separate user-controlled values from command or code construction
- Apply authentication and authorization checks consistently to RPC operations
- Run device services with the minimum privileges needed for file access
- Restrict network exposure of management and RPC interfaces
- Log rejected inputs and unusual file-write activity for investigation
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules identifying string concatenation between request parameters and commands, interpreters, or dynamic code paths
- Code review checks for file-write handlers that accept unrestricted path values
- Testing with metacharacter and boundary-case inputs in isolated environments
- Policy enforcement requiring allowlisted paths and non-shell process execution
- Runtime monitoring for unexpected file creation, modification, or child-process activity by the RPC service
Automated security review tools may help identify injection-prone data flows, but findings should be validated against the device's actual request-processing behavior.
Organizations can look for this class of issue through:
- Static analysis rules identifying string concatenation between request parameters and commands, interpreters, or dynamic code paths
- Code review checks for file-write handlers that accept unrestricted path values
- Testing with metacharacter and boundary-case inputs in isolated environments
- Policy enforcement requiring allowlisted paths and non-shell process execution
- Runtime monitoring for unexpected file creation, modification, or child-process activity by the RPC service
Automated security review tools may help identify injection-prone data flows, but findings should be validated against the device's actual request-processing behavior.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| vuldb. | vuldb.com/ |
| vuldb. | vuldb.com/ |
| vuldb. | vuldb.com/ |
| vuldb. | vuldb.com/ |
