H3C CVM: Unauthenticated arbitrary file upload leading to code execution
Summary
H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, has an unauthenticated arbitrary file upload flaw in the /cas/fileUpload/upload endpoint. The token parameter does not restrict path traversal or file type, so a remote attacker can write a malicious JSP file into a web-accessible directory and then request it to execute code as the web-server user. No authentication or user interaction is required, but the attacker needs network access to the CVM management interface. Shadowserver Foundation has observed exploitation attempts since 14 October 2023.
Affected
- H3C CVM (component of H3C CAS): affected versions unknown.
- The CNA record lists all versions as affected; no exact version range has been confirmed by the vendor.
Fixed in
Unknown. No vendor-confirmed fixed version found. Obtain the fixed version from H3C support.
Workaround
- No vendor workaround found.
- Do not expose the CVM management interface to the internet; restrict access to a management VLAN or VPN.
- Check web-accessible directories for unexpected JSP or script files.
Exploitation
- Exploitation in the wild reported; Shadowserver Foundation observed evidence starting 14 October 2023.
- Public exploit capability assumed: a Nuclei detection template is public and a CSDN write-up is referenced; reports on public exploit code conflict.
- CISA SSVC: exploitation PoC, automatable, total technical impact.
- CISA KEV: not listed according to one source; to be verified on cisa.gov.
Our recommendation
- Identify whether any H3C CAS/CVM instance exists and whether it is reachable from outside.
- Remove direct internet exposure of CVM immediately.
- Check for compromise: unknown JSP files in web directories, unusual web-server activity, unexpected outbound connections.
- Obtain the fixed version from H3C support and apply it.
- Review web logs for requests to /cas/fileUpload/upload from unknown sources.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: H3C CVM unauthenticated file upload www.vulncheck.com
- Nuclei template: H3C CVM arbitrary file upload github.com
- H3C CAS CVM user manual www.h3c.com
- VulDB: CVE-2023-54405 vuldb.com
- OpenCVE: CVE-2023-54405 app.opencve.io
- Vulners: RAPID7:CVE-2023-54405 vulners.com
- CSDN blog write-up (CVE-2023-54405) blog.csdn.net
- Shadowserver vulnerable HTTP report www.shadowserver.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:35.
Original description (NVD)
H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vulnerability in the /cas/fileUpload/upload endpoint that allows remote attackers to write arbitrary files by manipulating the caller-supplied token parameter without restricting path traversal or file type. Attackers can exploit the path traversal in the token parameter to upload a malicious JSP file into a web-accessible directory and then request it to achieve remote code execution as the web-server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
NVD references (4)
- https://blog.csdn.net/qq_41904294/article/details/134697278
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/h3c-cvm-arbitrary-f…
- https://www.h3c.com/en/Support/Resource_Center/EN/Cloud_Computing/Catalog/H3C_CAS/H3C_CAS/Technical_Documents…
- https://www.vulncheck.com/advisories/h3c-cvm-unauthenticated-file-upload-via-fileupload-upload-token
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.