The Rejetto HTTP File Server version 2.3m is vulnerable to remote code execution, allowing attackers to execute arbitrary code on the server. This vulnerability has been assigned the CVE-2024-23692.
The vulnerability in HFS HTTP File Server allows attackers to upload files and place them in arbitrary locations on the server by exploiting the software's inadequate input sanitization. This can lead to the execution of malicious files and potential attacks.
The vulnerabilities in HTTP File Server allow an attacker to download files from restricted directories or cause denial-of-service conditions. By accessing a specially crafted URL, an attacker can bypass security measures and download files from protected folders within the application's context. Additionally, the application is vulnerable to a denial-of-service attack triggered by a malformed search parameter.
This exploit allows an attacker to execute arbitrary commands on a target system running HFS (HTTP File Server) version 2.3.x. The vulnerability exists due to improper handling of user input, which allows an attacker to inject malicious commands. By exploiting this vulnerability, an attacker can gain unauthorized access and execute commands with the privileges of the HFS application.
rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-pointer write access violation via concurrent HTTP requests with a long URI or long HTTP headers like Cookie, User-Agent etc. Remote unauthenticated attackers can send concurrent HTTP requests using an incrementing or specific payload range of junk characters for values in the URL parameters or HTTP headers sent to the server. This results in hfs.exe server crash from an invalid pointer write access violation.
Rejetto HttpFileServer (HFS) is vulnerable to remote command execution attack due to a poor regex in the file ParserLib.pas. This module exploit the HFS scripting commands by using '%00' to bypass the filtering. This module has been tested successfully on HFS 2.3b over Windows XP SP3, Windows 7 SP1 and Windows 8.
The latest HTTP File Server (2.3c and maybe prior too) was found to be vulnerable to a remote command execution in the file comment features, because the application did not properly validate uft-8 broken byte representation, in fact during parsing program won't notice that there are multiple invalid representation and when they are printed into the page will get replaced with one of these characters " { . | } " causing a macro to be executed.
The vulnerability exists due to a poor regex in the file ParserLib.pas. It will not handle null byte so a request to http://localhost:80/?search=%00{.exec|cmd.} will stop regex from parse macro, and macro will be executed and remote code injection happen.
Rejetto HttpFileServer 2.3.x is vulnerable to Remote Command Execution. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable server. This request contains a malicious payload which is then executed on the server. This vulnerability was discovered by Óscar Andreu and is tracked as CVE-2014-6287.
Services By CQR