HTTP File Server vulnerabilities

4 known vulnerabilities in HTTP File Server from Rejetto. 4 are rated high or critical, and 2 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  http_file_server: Improper Neutralization of Special Elements used in an OS Command

  CVE-2024-39943Jul 4, 2024RejettoEPSS 39.5%

  rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSy

• 9.8 Critical severity

  Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Exploited

  CVE-2024-23692May 31, 2024RejettoEPSS 99.5%

  Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HT

• 7.5 High severity

  Http File Server: Improper Neutralization of CRLF Sequences

  CVE-2024-1226Mar 12, 2024Rejetto

  The software does not neutralize or incorrectly neutralizes certain characters before the data is included in outgoing HTTP headers. The inclusion of invalidated data in an HTTP header allows an attacker to specify the full HTTP response represented by the bro

• 9.8 Critical severity

  Rejetto HTTP File Server (HFS) Remote Code Execution Exploited

  CVE-2014-6287Oct 7, 2014RejettoEPSS 99.3%

  The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.