H3C iMC智能管理中心系统 /imc/autoDeploy.xhtml 命令执行漏洞

2024-12-06 H3C iMC智能管理中心系统 PoC No

Description

H3C IMC (Intelligent Management Center)智能管理中心是H3C推出的下一代业务智能管理产品。它融合了多个产品，以统一风格提供与网络相关的管理、控制、监控等功能。H3C IMC智能管理中心系统 autoDeploy.xhtml 接口存在远程代码执行漏洞，未经身份验证的攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个 web 服务器。

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

https://zhiliao.h3c.com/questions/dispcont/272223
https://blog.csdn.net/weixin_45790890/article/details/141530859
https://github.com/Yuan08o/pocs/blob/main/H3C/H3C-iMC%E6%99%BA%E8%83%BD%E7%AE%A1%E7%90%86%E4%B8%AD%E5%BF%83autoDeploy.xhtml%E5%AD%98%E5%9C%A8%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md
https://kms.h3c.com/questions/dispcont/275195
https://cn-sec.com/archives/3154248.html
https://blog.csdn.net/weixin_44337800/article/details/141228364
https://ddpoc.com/DVB-2024-7916.html
https://github.com/Mr-xn/Penetration_Testing_POC/blob/master/books/H3C-iMC%E6%99%BA%E8%83%BD%E7%AE%A1%E7%90%86%E4%B8%AD%E5%BF%83autoDeploy.xhtml%E9%A1%B5%E9%9D%A2%E4%BB%A3%E7%A0%81%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E%E5%88%86%E6%9E%90.html
https://rivers.chaitin.cn/blog/cqq52a10lnec5jjugdcg
https://x.threatbook.com/v5/article?threatInfoID=127193
https://blog.csdn.net/nnn2188185/article/details/141504323
https://www.vulncheck.com/advisories/h3c-intelligent-management-center-rce