跳转到帖子

Rejetto HTTP File Server (HFS) Unauthenticated Remote Code Execution

recommended_posts

发布于
  • Members

Rejetto HTTP File Server (HFS) Unauthenticated Remote Code Execution

Disclosed
05/25/2024
Created
06/11/2024

Description

The Rejetto HTTP File Server (HFS) version 2.x is vulnerable to an unauthenticated server side template injection (SSTI) vulnerability. A remote unauthenticated attacker can execute code with the privileges of the user account running the HFS.exe server process. This exploit has been tested to work against version 2.4.0 RC7 and 2.3m. The Rejetto HTTP File Server (HFS) version 2.x is no longer supported by the maintainers and no patch is available. Users are recommended to upgrade to newer supported versions.

Author(s)

  • sfewer-r7
  • Arseniy Sharoglazov

Platform

Windows

Architectures

cmd

Development

  • Source Code
  • History
  • 查看数 700
  • 已创建
  • 最后回复

参与讨论

你可立刻发布并稍后注册。 如果你有帐户,立刻登录发布帖子。

游客
回帖…