rejetto http file server vulnerabilities

Latest rejetto http file server CVEs

Newest publication first

1. CVE-2024-39943 rejetto HFS vulnerable to OS Command Execution by remote authenticated users

   Published 2024-07-04

   High·CVSS 8.8 EPSS 39.5%

   rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process...

2. CVE-2024-23692 Rejetto HTTP File Server 2.3m Unauthenticated RCE

   Published 2024-05-31

   Critical·CVSS 9.8 EPSS 99.5% CISA KEV added 2024-07-09 Ransomware Exploited in the wild Framework module Public exploit PoC

   Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of th...

3. CVE-2024-1227 Multiple vulnerabilities in Rejetto's Http File Server

   Published 2024-03-12

   Medium·CVSS 6.5 EPSS 0.49%

   An open redirect vulnerability, the exploitation of which could allow an attacker to create a custom URL and redirect a legitimate page to a malicious site.

4. CVE-2024-1226 Multiple vulnerabilities in Rejetto's Http File Server

   Published 2024-03-12

   High·CVSS 7.5 EPSS 0.45%

   The software does not neutralize or incorrectly neutralizes certain characters before the data is included in outgoing HTTP headers. The inclusion of invalidated data in an HTTP header allows an attacker to specify the full HTTP response represented by the browser. An attacker co...

5. CVE-2020-13432 rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-pointer write access violation via concurrent HTTP requests w...

   Published 2020-06-08

   High·CVSS 7.5 EPSS 30.9%

   rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-pointer write access violation via concurrent HTTP requests with a long URI or long HTTP headers.

6. CVE-2014-7226 The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary code by uploading a file with certain invalid UTF-8 byte sequences that are int...

   Published 2014-10-10

   High·CVSS 7.5 EPSS 9.2% Public exploit

   The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary code by uploading a file with certain invalid UTF-8 byte sequences that are interpreted as executable macro symbols.

7. CVE-2014-6287 The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a sea...

   Published 2014-10-07

   Critical·CVSS 9.8 EPSS 99.3% CISA KEV added 2022-03-25 Exploited in the wild Framework module Public exploit PoC

   The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.