PT-2023-9232 · Rejetto · Rejetto Http File Server

Arseniy Sharoglazov + 1 · Published 2023-08-18 · Updated 2026-05-04 · CVE-2024-23692

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Rejetto HTTP File Server versions 2.3m and earlier

Description The vulnerability is related to the improper neutralization of special elements used in a template engine, allowing a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. This issue has been exploited in real-world attacks, with threat actors targeting older versions of the HTTP File Server to drop malware and cryptocurrency mining software. The estimated number of potentially affected devices worldwide is not explicitly stated, but it is known that over 89,700 services are found to be vulnerable.

Recommendations For Rejetto HTTP File Server versions 2.3m and earlier, update to version 0.52.x, which is the recommended safe version of the product, as it is the latest release from the developer and includes support for HTTPS, dynamic DNS, and authentication for the administrative panel.

Note: The provided information does not include any vulnerability identifiers (e.g., CVE numbers) in the response as per the guidelines.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-1336

CWE-94

Related Identifiers

BDU:2024-05175

CVE-2024-23692

Affected Products

Rejetto Http File Server

References · 95

• 🔥 https://github.com/rapid7/metasploit-framework/pull/19240 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/rejetto_hfs_rce_cve_2024_23692.rb · Exploit
• 🔥 https://github.com/verylazytech/CVE-2024-23692 · Exploit
• 🔥 https://github.com/0x20c/CVE-2024-23692-EXP · Exploit
• 🔥 https://github.com/jakabakos/CVE-2024-23692-RCE-in-Rejetto-HFS · Exploit
• 🔥 https://github.com/vanboomqi/CVE-2024-23692 · Exploit
• 🔥 https://github.com/BBD-YZZ/CVE-2024-23692 · Exploit
• 🔥 https://github.com/XiaomingX/cve-2024-23692-poc · Exploit
• 🔥 https://github.com/k3lpi3b4nsh33/CVE-2024-23692 · Exploit
• 🔥 https://vulncheck.com/advisories/rejetto-unauth-rce · Exploit
• 🔥 https://vicarius.io/vsociety/posts/unauthenticated-rce-flaw-in-rejetto-http-file-server-cve-2024-23692 · Exploit
• 🔥 https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce · Exploit
• 🔥 https://exploit-db.com/exploits/52102 · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2024-23692-rejetto-hfs-mitigate-vulnerability · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2024-23692-detect-rejetto-hfs-vulnerability · Exploit