Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability

概要

参考情報

• packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html · Exploit
• packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Execution.html · Exploit
• packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execution.html · Exploit
• packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.html · Exploit
• kb.cert.org/vuls/id/251276 · Third Party Advisory
• rapid7/metasploit-framework#3793 · Exploit
• exploit-db.com/exploits/39161 · Exploit
• cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
• CISA KEV · CVE-2014-6287

http file server のその他の脆弱性

• CVE-2024-39943高 8.8rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if …
• CVE-2024-23692緊急 9.8悪用確認済み（CISA KEV）Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a…
• CVE-2020-13432高 7.5rejetto HFS (aka HTTP File Server) v2.3m Build #300, when virtual files or folders are used, allows remote attackers to trigger an invalid-p…
• CVE-2014-7226高 7.5The file comment feature in Rejetto HTTP File Server (hfs) 2.3c and earlier allows remote attackers to execute arbitrary code by uploading a…