Rejetto · HTTP File Server

CVE-2024-23692

Rejetto HTTP File Server 2.3m Unauthenticated RCE

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: 99.5%

What it is

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.

CISA: Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: July 30, 2024

Added to the CISA list: July 9, 2024
Published: May 31, 2024
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 99.5% in the top 0.1% of all known vulnerabilities
Weakness: CWE-1336
More details: NVD · CVE.org · CISA

All references (3)

More exploited flaws from Rejetto

Added	Vulnerability	Product	Severity	Attack chance
Mar 25, 2022	Remote Code ExecutionCVE-2014-6287	HTTP File Server (HFS)	Critical 9.8	99.3%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.