CVE-2024-23692 Scanner

Rejetto HTTP File Server (HFS) is a lightweight, open-source file-sharing application that enables users to host and share files over HTTP and HTTPS. It is commonly used by small businesses, IT administrators, and individuals for quick file transfers without complex server setups. HFS features a simple web-based interface, supports virtual file systems, and allows custom templates, making it a flexible tool for temporary or permanent file hosting in environments where ease of deployment is prioritized.

CVE-2024-23692 is a critical Remote Code Execution (RCE) vulnerability in Rejetto HFS versions prior to 2.4.0. The flaw arises from improper input validation in the handling of HTTP requests, specifically within the template parsing functionality. Attackers can craft malicious requests that inject arbitrary commands, which are then executed on the server with the privileges of the HFS process. This vulnerability is classified as critical due to its low complexity and network-based attack vector.

The vulnerability exists in the HFS web interface's template engine, which processes user-supplied data without adequate sanitization. Specifically, the vulnerable endpoint is the main HTTP handler that processes file requests and template variables. By sending a specially crafted HTTP request containing command injection payloads in parameters like the filename or path, an attacker can trigger arbitrary command execution. The flaw is present in the default configuration and does not require authentication.

Successful exploitation of CVE-2024-23692 allows an attacker to execute arbitrary commands on the target server, potentially leading to full system compromise. This can result in data theft, installation of malware, lateral movement within the network, or complete denial of service. Given the CVSS score of 9.8, this vulnerability poses a severe risk to any organization using vulnerable versions of Rejetto HFS, especially if the server is exposed to the internet.