CVEvulnerability

CVE-2024-23692

9.8 CRITICAL Known exploited Published 2024-05-31 Modified 2026-08-11 Official page ↗

CISA Known Exploited Vulnerability

Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability — Rejetto HTTP File Server

Rejetto HTTP File Server contains an improper neutralization of special elements used in a template engine vulnerability. This allows a remote, unauthenticated attacker to execute commands on the affected system by sending a specially crafted HTTP request.

Added to KEV
2024-07-09
Remediation due
2024-07-30
Ransomware use
Known
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes
The patched Rejetto HTTP File Server (HFS) is version 3: https://github.com/rejetto/hfs?tab=readme-ov-file#installation, https://www.rejetto.com/hfs/ ; https://nvd.nist.gov/vuln/detail/CVE-2024-23692
Status
Analyzed
Published
2024-05-31
Last modified
2026-08-11
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1336, CWE-94

Description

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.

Affected configurations

• rejetto http file server (<= 2.4)

Related

Weakness · CWE (2)

  • CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine weakness
  • CWE-94 Improper Control of Generation of Code weakness

References