Exploit for Code Injection in Rejetto Http_File_Server

This is a PoC exploit for CVE-2024-23692, a remote code executio...

CVE-2024-23692

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment...

Exploit for Code Injection in Rejetto Http_File_Server

CVE-2024-23692-poc CVE-2024-23692 is a template injection vu...

Rejetto HTTP File Server 2.x <= 2.3m RCE (CVE-2024-23692) (direct check)

Binary data rejettohfsrceCVE-2024-23692.nbin...

Rejetto HTTP File Server 2.x <= 2.3m RCE (CVE-2024-23692)

The version of Rejetto HTTP File Server installed on the remote host is 2.x up to 2.3m. It is, therefore, affected by a vulnerability: - Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote,...

Rejetto HTTP File Server (HFS) Service Detection

Binary data rejettohttpfileserverdetect.nbin...

Exploit for Code Injection in Rejetto Http_File_Server

An unauth SSTI in the Rejetto HTTP File Server HFS. Original...

Exploit for Code Injection in Rejetto Http_File_Server

An unauth SSTI in the Rejetto HTTP File Server HFS. Original...

Rejetto HTTP File Server template injection

Added: 07/10/2024 Background Rejetto HTTP File Server is a web-based file system application. Problem A template injection vulnerability allows remote attackers to execute arbitrary commands by sending a specially crafted GET request. Resolution Upgrade to a version higher than HTTP File Server H...

Rejetto HTTP File Server template injection

Added: 07/10/2024 Background Rejetto HTTP File Server is a web-based file system application. Problem A template injection vulnerability allows remote attackers to execute arbitrary commands by sending a specially crafted GET request. Resolution Upgrade to a version higher than HTTP File Server H...

Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request...

GHSA-5F4X-HWV2-W9W2 rejetto HFS vulnerable to OS Command Execution by remote authenticated users

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

rejetto HFS vulnerable to OS Command Execution by remote authenticated users

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

CVE-2024-39943

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

CVE-2024-39943

CVE-2024-39943 affects rejetto HFS (HTTP File Server) before v0.52.10 on Linux/UNIX/macOS. The root cause is that the server executes OS commands via a shell (execSync) to run df during file upload, enabling remote authenticated users with Upload permissions to achieve remote code execution. Conn...

CVE-2024-39943

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

PT-2024-28745

Name of the Vulnerable Software and Affected Versions rejetto HFS aka HTTP File Server 3 versions prior to 0.52.10 Description Remote authenticated users with upload permissions can execute operating system commands on Linux, UNIX, and macOS. This issue occurs because the software uses a shell to...

CVE-2024-39943: Improper Neutralization of Special Elements used in an OS Command

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

CVE-2024-39943

rejetto HFS aka HTTP File Server 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users if they have Upload permissions. This occurs because a shell is used to execute df i.e., with execSync instead of spawnSync in childprocess in Node.js...

rejetto HFS Security Vulnerability

rejetto HFS is a web-based file server from the individual developer Massimo Melina in Italy. A security vulnerability exists in rejetto HFS versions prior to 0.52.10, which originates from allowing an authenticated remote user to execute operating system commands...