CVE-2014-6287

9.8

CVSS
Critical

PUBLISHED

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to...

Exploited in the wild Remote Low complexity No user interaction

Vendor: Rejetto
Product: HTTP File Server
Published: Oct 07, 2014
EPSS: —

Description

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.

cisa nuclei_scanner metasploit

CVSS scores

CVSS v3.1 9.8 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 10.0

AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitation status

Exploited in the wild

Recorded 2022-03-25 00:00:00 UTC · Source

SSVC decision points

Exploitation: active
Automatable: Yes
Technical impact: total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source	Added
CISA	Mar 25, 2022

Scanner integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/rejetto_hfs_exec.rb	Apr 28, 2025
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-6287.yaml	Apr 25, 2025

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

rejetto_hfs_exec

metasploit · Created Unknown

Metasploit module for CVE-2014-6287

10cks/CVE-2014-6287

github · Created 2024-06-12 06:08:19 UTC · 0 stars

Rejetto http File Server 2.3.x (Reverse shell)

zhsh9/CVE-2014-6287

github · Created 2024-03-06 20:55:08 UTC · 0 stars

Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c

mrintern/thm_steelmountain_CVE-2014-6287

github · Created 2021-12-03 12:13:35 UTC · 1 stars

a python3 version of the exploit written for CVE-2014-6287. Useful for completing the "Steel Mountain" room on TryHackMe.com without the use of metasploit.

wizardy0ga/THM-Steel_Mountain-CVE-2014-6287

github · Created 2021-12-02 15:15:09 UTC · 0 stars

A write up on the Steel Mountain box from TryHackMe.com and exploit for CVE-2014-6287

Nicoslo/Windows-exploitation-Rejetto-HTTP-File-Server-HFS-2.3.x-CVE-2014-6287

github · Created 2021-02-20 18:28:16 UTC · 1 stars

Vulnerability detail