Home

Description

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.

PUBLISHED Reserved 2024-01-19 | Published 2024-05-31 | Updated 2025-11-22 | Assigner VulnCheck




CRITICAL: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA Known Exploited Vulnerability

Date added 2024-07-09 | Due date 2024-07-30

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Problem types

CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine

Product status

Default status
unaffected

Any version
affected

Credits

Arseniy Sharoglazov finder

References

www.cisa.gov/...erabilities-catalog?field_cve=CVE-2024-23692 government-resource

www.vicarius.io/...n-rejetto-http-file-server-cve-2024-23692

www.vicarius.io/...24-23692-detect-rejetto-hfs-vulnerability

www.vicarius.io/...-23692-rejetto-hfs-mitigate-vulnerability

vulncheck.com/advisories/rejetto-unauth-rce third-party-advisory

mohemiv.com/...to-http-file-server-2-3m-unauthenticated-rce/ third-party-advisory technical-description

github.com/rapid7/metasploit-framework/pull/19240

vulncheck.com/advisories/rejetto-unauth-rce third-party-advisory

mohemiv.com/...to-http-file-server-2-3m-unauthenticated-rce/ third-party-advisory technical-description

github.com/rapid7/metasploit-framework/pull/19240

cve.org (CVE-2024-23692)

nvd.nist.gov (CVE-2024-23692)

Download JSON