The Rejetto HTTP File Server version 2.3m is vulnerable to remote code execution, allowing attackers to execute arbitrary code on the server. This vulnerability has been assigned the CVE-2024-23692.
The vulnerabilities in HTTP File Server allow an attacker to download files from restricted directories or cause denial-of-service conditions. By accessing a specially crafted URL, an attacker can bypass security measures and download files from protected folders within the application's context. Additionally, the application is vulnerable to a denial-of-service attack triggered by a malformed search parameter.
The latest HTTP File Server (2.3c and maybe prior too) was found to be vulnerable to a remote command execution in the file comment features, because the application did not properly validate uft-8 broken byte representation, in fact during parsing program won't notice that there are multiple invalid representation and when they are printed into the page will get replaced with one of these characters " { . | } " causing a macro to be executed.
Services By CQR