module
Rejetto HTTP File Server (HFS) Unauthenticated Remote Code Execution
| Disclosed |
|---|
| May 25, 2024 |
Disclosed
May 25, 2024
Description
The Rejetto HTTP File Server (HFS) version 2.x is vulnerable to an unauthenticated server side template
injection (SSTI) vulnerability. A remote unauthenticated attacker can execute code with the privileges
of the user account running the HFS.exe server process. This exploit has been tested to work against version
2.4.0 RC7 and 2.3m. The Rejetto HTTP File Server (HFS) version 2.x is no longer supported by the maintainers
and no patch is available. Users are recommended to upgrade to newer supported versions.
injection (SSTI) vulnerability. A remote unauthenticated attacker can execute code with the privileges
of the user account running the HFS.exe server process. This exploit has been tested to work against version
2.4.0 RC7 and 2.3m. The Rejetto HTTP File Server (HFS) version 2.x is no longer supported by the maintainers
and no patch is available. Users are recommended to upgrade to newer supported versions.
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.