CVE-2024-23692

Rejetto HTTP File Server 2.3m Unauthenticated RCE

Basic Information

CVE State: PUBLISHED
Reserved Date: January 19, 2024
Published Date: May 31, 2024
Last Updated: February 13, 2025
Vendor: Rejetto
Product: HTTP File Server
Description: Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.

CVSS Scores

CVSS v3.1

9.8 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC Information

Exploitation: active
Automatable: Yes
Technical Impact: total

Exploit Status

Exploited in the Wild: Yes (added 2024-07-09 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2024-06-11 07:21:04 UTC) Source

References

https://vulncheck.com/advisories/rejetto-unauth-rce https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce/ https://github.com/rapid7/metasploit-framework/pull/19240

Known Exploited Vulnerability Information

Source	Added Date
CISA	2024-07-09 00:00:00 UTC

Scanner Integrations

Scanner	URL	Date Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/rejetto_hfs_rce_cve_2024_23692.rb	2025-04-29 11:01:39 UTC
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-23692.yaml	2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

rejetto_hfs_rce_cve_2024_23692

Type: metasploit • Created: Unknown

Metasploit module for CVE-2024-23692

verylazytech/CVE-2024-23692

Type: github • Created: 2024-09-15 12:15:35 UTC • Stars: 41

POC - Unauthenticated RCE Flaw in Rejetto HTTP File Server - CVE-2024-23692

0x20c/CVE-2024-23692-EXP

Type: github • Created: 2024-06-18 03:27:47 UTC • Stars: 14

CVE-2024-23692 Exploit

BBD-YZZ/CVE-2024-23692

Type: github • Created: 2024-06-17 08:46:48 UTC • Stars: 5

CVE-2024-23692

vanboomqi/CVE-2024-23692

Type: github • Created: 2024-06-13 09:12:06 UTC • Stars: 9

jakabakos/CVE-2024-23692-RCE-in-Rejetto-HFS

Type: github • Created: 2024-06-13 06:00:24 UTC • Stars: 10

Unauthenticated RCE Flaw in Rejetto HTTP File Server (CVE-2024-23692)

k3lpi3b4nsh33/CVE-2024-23692

Type: github • Created: 2024-06-11 07:21:04 UTC • Stars: 3