critical9.8Known exploitedPublic exploit code
CVE-2014-6287
Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-03-25. Federal due date: 2022-04-15.
Apply updates per vendor instructions.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (2)2016-01-04 · remote · windows · Verified
- Rejetto HTTP File Server (HFS) - Remote Command Execution (Metasploit)2014-10-09 · remote · windows · Verified
- Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (1)2014-09-15 · remote · windows · Verified
- Rejetto HttpFileServer 2.3.x - Remote Command Execution (3)2020-11-30 · webapps · windows
Impact
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rejetto | Http File Server | from 2.3 before 2.3c |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.html
- http://www.kb.cert.org/vuls/id/251276
- https://github.com/rapid7/metasploit-framework/pull/3793
- https://www.exploit-db.com/exploits/39161/
- http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execution.html
- http://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.html
- http://www.kb.cert.org/vuls/id/251276
- https://github.com/rapid7/metasploit-framework/pull/3793
- https://www.exploit-db.com/exploits/39161/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6287