CVE-2023-54405

Executive Summary

CVE-2023-54405 is a critical unauthenticated arbitrary file upload vulnerability in H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform. The flaw resides in the /cas/fileUpload/upload endpoint, where a caller-supplied token parameter is used without restricting path traversal or file type, allowing unauthenticated remote attackers to write arbitrary files and achieve remote code execution. With a CVSS score of 9.8 and evidence of exploitation observed in the wild as early as 2023-10-14, any internet-exposed H3C CVM instance is at immediate and severe risk.

Technical Analysis

The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and stems from insufficient validation of the caller-supplied token parameter in the /cas/fileUpload/upload endpoint of H3C CVM, a component of the H3C CAS cloud platform.

The core mechanism has two compounding weaknesses:

1. Path traversal in the token parameter — The endpoint uses a caller-supplied token value when constructing the destination path for uploaded content. Because the parameter is not sanitized for traversal sequences, an attacker can manipulate it to redirect the write operation into an arbitrary directory on the filesystem. This lets an attacker place a file outside the intended upload directory, specifically into a directory that is web-accessible.

2. No file-type restriction — The upload logic does not restrict the file extension or content type. Combined with the traversal weakness, an attacker can write a malicious JSP file into a web-accessible directory.

The endpoint performs no authentication check, so both weaknesses are reachable by an unauthenticated remote attacker over the network (CVSS AV:N, PR:N, UI:N). Once a JSP file is written into a web-accessible directory, the attacker requests it directly; the web server then executes it as the web-server user, yielding remote code execution.

Because no public PoC, Nuclei template, or exploit code is available for this CVE, the exact traversal string, the token format, and the precise web-accessible directory are not documented here. The attack chain is inferred from the vulnerability class and the NVD description.

Exploitation Scenarios

The following chain is described strictly at the vulnerability-class level, based on the NVD description. No public PoC is available; the attack chain is inferred from the vulnerability class.

1. Reconnaissance / target identification — An attacker scans for internet-exposed H3C CVM instances, identifying hosts that expose the /cas/fileUpload/upload endpoint. Because the endpoint is unauthenticated, no credentials are required to reach the upload handler.

2. Triggering the flaw class — The attacker sends a crafted upload request to /cas/fileUpload/upload, supplying a token parameter containing path traversal sequences. The unsanitized token is used to build the destination path, redirecting the write outside the intended upload directory and into a web-accessible location. The upload is not restricted by file type, so a JSP file is accepted.

3. Payload / execution method (vulnerability class level) — The attacker uploads a malicious JSP file. Once written into the web-accessible directory, the attacker requests the file over HTTP, causing the web server to execute it as the web-server user. This converts the arbitrary file write into remote code execution. The specific JSP payload content is attacker-controlled and not defined by the CVE.

4. Post-exploitation impact — Successful execution yields code execution in the context of the web-server user. From there, an attacker can read or modify application data, establish persistence, pivot to other systems reachable from the compromised host, and, given the CAS platform is a cloud virtualization management component, potentially tamper with or access virtualization management functions. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14, indicating active in-the-wild attempts.

Impact Assessment

The CVSS 3.1 base score is 9.8 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The subscores reflect the most severe outcome:

• Confidentiality: High (C:H) — Code execution as the web-server user exposes application data, configuration, and potentially credentials handled by the CVM component.
• Integrity: High (I:H) — An attacker can write arbitrary files and execute arbitrary code, modifying application behavior and stored data.
• Availability: High (A:H) — Code execution and file-write capabilities allow an attacker to disrupt or disable the management component.
• Attack Vector: Network (AV:N) — Exploitable remotely over the network.
• Attack Complexity: Low (AC:L) — No special conditions or race windows are required.
• Privileges Required: None (PR:N) — The endpoint is unauthenticated.
• User Interaction: None (UI:N) — No victim action is needed.
• Scope: Unchanged (S:U) — Impact is confined to the vulnerable component's security authority.

Business impact: H3C CAS is a cloud platform, and CVM is its Cloud Virtualization Management component. Compromise of the management plane of a virtualization platform is high-severity: an attacker with code execution on the management component may be positioned to affect managed virtualization infrastructure and workloads. Given the unauthenticated nature and the observed exploitation evidence, internet-exposed instances carry immediate risk. EPSS has not yet been scored by FIRST.org, and the CVE is not listed in CISA KEV as of this report.

Detection Guidance

Sigma Rule

title: H3C CVM Unauthenticated Arbitrary File Upload (CVE-2023-54405)
id: 8f6a1c2e-3b4d-4e5f-9a7b-1c2d3e4f5a6b
status: experimental
description: Detects exploitation attempts against the H3C CVM /cas/fileUpload/upload endpoint via HTTP POST requests containing path traversal sequences and JSP file indicators.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2023-54405
author: valtersit.com
date: 2024-01-01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-method: 'POST'
    cs-uri-stem|contains: '/cas/fileUpload/upload'
  selection_traversal:
    cs-uri-query|contains:
      - '../'
      - '..%2f'
      - '..%5c'
      - '%2e%2e%2f'
  selection_jsp:
    cs-uri-query|contains: '.jsp'
  condition: selection_endpoint and (selection_traversal or selection_jsp)
falsepositives:
  - Legitimate administrative uploads, if any exist
level: critical

YARA Rule

rule CVE_2023_54405_H3C_CVM_JSP_Upload
{
    meta:
        description = "Detects malicious JSP files uploaded via H3C CVM /cas/fileUpload/upload (CVE-2023-54405)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-54405"
        author = "valtersit.com"
        date = "2024-01-01"
        severity = "critical"

    strings:
        $jsp1 = "<%@ page" ascii nocase
        $jsp2 = "<jsp:" ascii nocase
        $jsp3 = "Runtime.getRuntime" ascii
        $jsp4 = "ProcessBuilder" ascii
        $jsp5 = "request.getParameter" ascii

    condition:
        (uint32(0) != 0x504b0304) and
        (2 of ($jsp*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2023-54405 H3C CVM Unauthenticated Arbitrary File Upload Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/cas/fileUpload/upload"; http.uri; content:".."; http.uri; pcre:"/(\.\.\/|%2e%2e%2f|%2e%2e%5c)/i"; reference:cve,2023-54405; classtype:web-application-attack; sid:202354405; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=1m
  [ network where http.request.method == "POST" and url.path == "/cas/fileUpload/upload" ]
  [ network where http.request.method in ("GET", "POST") and url.path : "*.jsp" ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval uri_lower = lower(uri)
| where like(uri_lower, "%/cas/fileupload/upload%") AND (like(uri_lower, "%..%") OR like(uri_lower, "%.jsp%") OR like(uri_lower, "%2e%2e%2f%"))
| stats count min(_time) as first_seen max(_time) as last_seen values(status) as status_codes by src_ip, uri, method, useragent
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2023-54405,">
  <rule id="100405" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <field name="url">/cas/fileUpload/upload</field>
    <regex type="pcre2">(?i)(\.\./|%2e%2e%2f|\.jsp)</regex>
    <description>CVE-2023-54405: Potential H3C CVM unauthenticated arbitrary file upload attempt (path traversal / JSP upload)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2023_54405,attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version range is available from tracked sources.

1. Immediate mitigations

• Restrict network access to /cas/fileUpload/upload and to the H3C CVM management interface. Do not expose CVM directly to the internet; place it behind a VPN or an allowlisted management network.
• Apply a reverse-proxy/WAF rule that blocks requests to /cas/fileUpload/upload containing path traversal sequences or JSP file extensions.
• Deny execution of newly written files in upload/web-accessible directories, and disable script execution in directories not intended to serve dynamic content.
• Monitor and alert on unauthenticated POSTs to the endpoint, especially followed by requests to .jsp resources.

2. Patch/upgrade steps

• No patch is currently identified from tracked sources. Contact H3C support directly to obtain an official fix or security advisory and apply the vendor-recommended version when available.
• Track the NVD entry for CVE-2023-54405 for patch and affected-version updates.

3. Long-term hardening

• Enforce strict input validation on the token parameter, rejecting traversal sequences and any caller-supplied path components.
• Enforce server-side file-type allowlisting and store uploads outside the web root.
• Require authentication and authorization for all upload endpoints.
• Apply least privilege to the web-server user and segment virtualization management components from general network access.

References

• NVD — CVE-2023-54405: https://nvd.nist.gov/vuln/detail/CVE-2023-54405
• CWE-434 — Unrestricted Upload of File with Dangerous Type: https://cwe.mitre.org/data/definitions/434.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Shadowserver Foundation — exploitation evidence for CVE-2023-54405 first observed 2023-10-14.
• CISA KEV catalog (status check — CVE-2023-54405 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog