CVE-2024-23692
Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Description
CVE-2024-23692 is a critical template injection vulnerability in Rejetto HTTP File Server (HFS) versions up to and including 2.3m that enables unauthenticated remote code execution. An attacker can execute arbitrary commands on the affected system by sending specially crafted HTTP requests that exploit the template engine. With a CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and an EPSS score of 0.94297 (99.9th percentile), this vulnerability has been listed in CISA's KEV catalog with a remediation deadline of July 30, 2024. Notably, HFS version 2.3m has reached end of life and is no longer supported by the vendor.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| rejetto | http file server | <= 2.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/rapid7/metasploit-framework/pull/19240(Exploit, Issue Tracking, Patch)
- https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce/(Exploit)
- https://vulncheck.com/advisories/rejetto-unauth-rce(Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2024-23692-detect-rejetto-hfs-vulnerability(Exploit, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/cve-2024-23692-rejetto-hfs-mitigate-vulnerability(Exploit, Third Party Advisory)
- https://www.vicarius.io/vsociety/posts/unauthenticated-rce-flaw-in-rejetto-http-file-server-cve-2024-23692(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23692(US Government Resource)
Weakness Type
Template Injection Leading to Remote Code Execution
CVE-2024-23692 is a server-side template injection (SSTI) vulnerability in Rejetto HTTP File Server. Template injection occurs when user-supplied input is embedded into a template engine in an unsafe manner, allowing an attacker to inject template directives that are executed by the server. In HFS, the template engine processes HTTP request data without adequate sanitization, enabling an attacker to inject template expressions that execute system-level commands. This vulnerability class is particularly dangerous because template engines often have access to the full runtime environment of the application, providing direct pathways to operating system command execution without the need for complex exploitation chains.
Impact Analysis
Complete Server Compromise is the direct impact of CVE-2024-23692. Rejetto HFS is a lightweight HTTP file server commonly used for personal file sharing and small-to-medium file distribution. While it is not an enterprise-grade product, its widespread use and the critical nature of this vulnerability create significant risk.
Confidentiality Impact is maximum (C:H). Remote code execution on the HFS server grants access to all files shared through the server, as well as any other files accessible on the host system. HFS instances are specifically designed to share files, meaning they often contain the data that users consider important enough to transfer, which may include sensitive documents, credentials, and proprietary information.
Integrity Impact is maximum (I:H). An attacker with command execution can modify or replace files served by HFS, inject malware into shared files, install backdoors on the host system, and use the compromised server as a staging point for further attacks. The file server context makes this particularly dangerous for supply chain attacks, where an attacker replaces legitimate shared files with trojanized versions.
Availability Impact is maximum (A:H). The attacker can shut down the HFS service, destroy shared files, encrypt the host system for ransom, or overwhelm system resources. For organizations relying on HFS for file distribution, this disrupts critical file sharing operations.
End-of-Life Risk: HFS version 2.3m is no longer supported, meaning no official patches will be released. Organizations using this version face a permanent vulnerability unless they migrate to an alternative solution. The EPSS score of 0.94297 (99.9th percentile) and CISA's KEV listing confirm extensive exploitation. CISA lists the ransomware association as "Unknown," though the ease of exploitation makes this an attractive target for ransomware operators.
Exploit Maturity
CVE-2024-23692 is confirmed as actively exploited in the wild, as documented by its listing in CISA's KEV catalog with a remediation deadline of July 30, 2024. The EPSS score of 0.94297 (99.9th percentile) confirms near-maximum exploitation probability.
Metasploit Module Available: The vulnerability has been integrated into the Metasploit framework, providing attackers with a ready-to-use exploit module. Metasploit integration dramatically lowers the barrier to exploitation, making the vulnerability accessible to attackers of all skill levels.
Multiple Public Exploits: Beyond Metasploit, the original researcher published detailed exploitation techniques demonstrating the full unauthenticated RCE chain. Additional analysis has been published by VulnCheck and Vicarius, with detection scripts and mitigation guidance.
Mass Scanning and Exploitation: The simplicity of exploitation through HTTP requests, combined with public exploit availability, has led to widespread automated scanning for vulnerable HFS instances. Internet-exposed HFS servers are being actively targeted by multiple threat actors.
Ransomware Association: CISA lists the ransomware status as "Unknown." The combination of trivial exploitation, Metasploit availability, and the typical deployment of HFS on systems with valuable file collections makes this vulnerability highly attractive for ransomware operators seeking quick wins against easily exploitable targets.
Remediation
-
Discontinue use of Rejetto HFS 2.3m and earlier versions as these are end-of-life software that will not receive security patches. Migrate to an alternative file sharing solution such as a modern web server with file sharing capabilities, cloud-based file transfer services, or the newer HFS 3.x if continued use of the Rejetto platform is desired (verify that HFS 3.x is not affected by this vulnerability before deploying).
-
Take vulnerable HFS instances offline immediately if migration cannot be completed quickly. The severity of unauthenticated remote code execution combined with public exploit availability means every internet-exposed HFS 2.3m instance is at imminent risk. Disconnect the service from the network until a secure alternative is deployed.
-
Audit systems running HFS for signs of compromise by examining running processes for unexpected commands spawned by the HFS process, checking for newly created user accounts, reviewing file system changes for backdoors or malware, and monitoring network connections for command-and-control traffic. Pay special attention to whether shared files have been modified or replaced with malicious versions.
-
Implement network-level access controls as an emergency measure if HFS must remain operational temporarily. Restrict access to the HFS port (typically TCP 80 or a custom port) using firewall rules that allow connections only from known, trusted IP addresses. Deploy an intrusion detection system to monitor for exploitation attempts against the HFS instance.
-
Scan the internal network for undocumented HFS instances as HFS is often deployed informally by individual users or departments without IT oversight. Search for the HFS process name, scan for open HTTP ports serving HFS content, and check software inventory systems for Rejetto HFS installations. Any discovered instances should be immediately shut down and replaced with approved file sharing solutions.
Technical Details
CVE-2024-23692 is a template injection vulnerability in Rejetto HTTP File Server (HFS) versions up to and including 2.3m that provides unauthenticated remote code execution through crafted HTTP requests.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H produces a base score of 9.8. The network attack vector (AV:N) confirms remote exploitation through HTTP. Low attack complexity (AC:L) reflects the straightforward nature of template injection. No privileges (PR:N) or user interaction (UI:N) are required. The scope is unchanged (S:U), and all impact metrics are maximum (C:H/I:H/A:H), reflecting complete system compromise.
Vulnerability Mechanism: Rejetto HFS uses a template engine to dynamically generate HTTP responses, including directory listings and error pages. The template engine processes certain values from incoming HTTP requests (such as URL parameters, headers, or path components) and embeds them into templates for rendering. The application fails to sanitize these request-derived values before template processing, allowing an attacker to inject template directives that the engine interprets and executes.
Template Injection to Command Execution: The HFS template engine supports directives that can interact with the operating system, including the ability to execute system commands. An attacker crafts an HTTP request containing template injection payloads in the vulnerable request parameters. When HFS processes the request through its template engine, the injected directives are evaluated, causing the server to execute the attacker's commands with the privileges of the HFS process. The original researcher's writeup documents the specific template syntax and injection points used for exploitation.
End-of-Life Implications: HFS version 2.3m is designated as end-of-life by the vendor as of the CVE assignment date. This means no official security patches will be released to address this vulnerability. All organizations running HFS 2.3m or earlier are permanently vulnerable and must migrate to alternative solutions. The vulnerability also affects versions up to 2.4, broadening the affected scope beyond the originally identified 2.3m version.
Frequently Asked Questions
What is CVE-2024-23692?
CVE-2024-23692 is a critical template injection vulnerability in Rejetto HTTP File Server (HFS) that allows unauthenticated remote attackers to execute arbitrary system commands by sending specially crafted HTTP requests. It affects HFS versions up to and including 2.3m (and up to 2.4), with the software designated as end-of-life by the vendor.
Is there a patch available for CVE-2024-23692?
No. Rejetto HFS version 2.3m has reached end of life and is no longer supported. No security patches will be released for this version. The only mitigation is to discontinue use of the affected versions and migrate to an alternative file sharing solution. If you wish to continue using the Rejetto platform, verify whether HFS 3.x addresses this vulnerability.
How easy is it to exploit CVE-2024-23692?
Extremely easy. The vulnerability requires only standard HTTP requests with injected template expressions. A Metasploit module is publicly available, as are multiple detailed exploit writeups and detection scripts. Any internet-facing HFS instance running an affected version should be considered compromised or at imminent risk of compromise.
Why is Rejetto HFS still in use if it is end-of-life?
HFS is popular because of its simplicity. It is a standalone executable that requires no installation, making it convenient for quick file sharing. Many users deploy it informally without IT oversight, creating a significant shadow IT risk. Organizations should scan their networks for unauthorized HFS instances and replace them with approved, actively maintained alternatives.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.