Rejetto · HTTP File Server (HFS)
CVE-2014-6287
Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability
What it is
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.
CISA: The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: April 15, 2022
- Added to the CISA list
- March 25, 2022
- Published
- October 7, 2014
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 99.3% in the top 0.1% of all known vulnerabilities
- Weakness
- CWE-94
- More details
- NVD · CVE.org · CISA
All references (7)
- http://www.kb.cert.org/vuls/id/251276
- https://www.exploit-db.com/exploits/39161/
- http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html
- https://github.com/rapid7/metasploit-framework/pull/3793
- http://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.html
More exploited flaws from Rejetto
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jul 9, 2024 | Improper Neutralization of Special Elements Used in a Template Engine | HTTP File Server | Critical 9.8 | 99.5% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.