CVE-2024-23692

What it actually does

Rejetto HTTP File Server 2.3m and earlier contains an unauthenticated server-side template injection flaw that can be reached over HTTP. By placing HFS template/macro syntax in a crafted request, an attacker can cause the server to evaluate attacker-controlled template directives and execute operating-system commands in the security context of the HFS process. Because the flaw is remotely reachable, requires no credentials, and can provide full confidentiality, integrity, and availability impact, successful exploitation commonly results in complete host compromise.

Why it matters to the business

Internet-exposed Rejetto HFS 2.x instances are high-risk assets: an attacker can take over the server, steal or alter files being shared, deploy malware, pivot to internal systems, or use the host for ransomware operations. This vulnerability is in CISA KEV, has very high EPSS likelihood, is reported as exploited in the wild, and is associated with ransomware activity; the CISA remediation deadline of 2024-07-30 has already passed. Since Rejetto HFS 2.3m is no longer supported, continued operation creates ongoing operational, legal, and data-loss risk.

How an attack unfolds

An attacker first identifies an exposed Rejetto HFS 2.x web interface, often by banner, page title, favicon, or characteristic HFS responses. They then send a specially crafted unauthenticated HTTP request containing HFS template/macro syntax that the server incorrectly interprets as trusted template content. When the vulnerable server evaluates the injected template expression, it runs attacker-selected operating-system commands as the user account running HFS. Initial commands are typically used to verify execution, download a payload, create persistence, disable defenses, or launch PowerShell/cmd-based tooling. In observed real-world activity against similar exposed file-sharing services, compromise may progress from command execution to credential theft, web shell or backdoor deployment, lateral movement, data staging, and ransomware deployment.

How to fix it

Remove or replace Rejetto HFS 2.3m and earlier; these versions are no longer supported and no fixed 2.x version should be relied upon. Migrate to a currently maintained file-sharing platform or a maintained HFS release line only after validating that it is not affected and is configured securely. If immediate replacement is not possible, take the service off the public internet, restrict access with VPN or allowlisted source IPs, place it behind an authenticated reverse proxy, and block requests containing HFS macro/template syntax at a WAF or reverse proxy. Run the service under a dedicated low-privilege account, remove write access where not required, isolate it from internal networks, and rotate credentials or secrets that may have been accessible from the host. Because exploitation is active and ransomware-associated, treat exposed vulnerable systems as potentially compromised and perform incident-response triage before returning them to service.

How to confirm the fix worked

Confirm that no Rejetto HFS 2.3m or earlier service remains reachable from the internet or untrusted networks. Validate externally using authenticated asset inventory, network scanning, and HTTP fingerprinting for HFS-specific pages, titles, headers, and icons. On the host, verify the installed/running binary version and ensure the legacy 2.x process is stopped or removed. If a compensating control is used temporarily, test that unauthenticated requests containing HFS macro delimiters or command-execution-related template syntax are blocked and logged. Review firewall and reverse-proxy rules to ensure only intended trusted sources can reach the service. After remediation, monitor for any new process creation from the HFS process and any repeat HTTP requests containing suspicious template syntax.

Typical attack path

1. Scan the internet or a target range for exposed Rejetto HTTP File Server 2.x services.
2. Confirm the service/version through HTTP headers, page content, title, or HFS-specific interface artifacts.
3. Send a crafted unauthenticated HTTP request containing malicious HFS template/macro syntax.
4. Trigger server-side evaluation of the injected template content.
5. Execute operating-system commands under the HFS process account.
6. Download and run a second-stage payload such as a reverse shell, loader, remote access tool, or ransomware precursor.
7. Establish persistence, collect credentials, enumerate accessible shares, and stage or exfiltrate data.
8. Move laterally or deploy ransomware if the host has access to broader internal resources.

How to detect it

Review HTTP access logs, reverse-proxy logs, WAF logs, firewall logs, EDR telemetry, and host process-creation logs for unauthenticated requests to HFS containing template/macro syntax, encoded braces, command-execution keywords, or suspicious downloader commands. Look for requests with unusual query strings containing HFS macro delimiters such as `{.` and `.}`, URL-encoded equivalents, or command strings invoking Windows shells. On Windows hosts, prioritize process lineage where the HFS executable launches command interpreters, scripting engines, download utilities, archive tools, or unknown binaries. Investigate creation of unexpected files in the HFS directory, shared folders, temporary directories, user profile paths, startup folders, scheduled tasks, services, and antivirus exclusion settings. Correlate suspicious HTTP requests with subsequent outbound network connections to unfamiliar IPs/domains, PowerShell script block logs, Sysmon Event ID 1 process creation, Windows Security Event ID 4688 process creation, service creation events, scheduled task creation, and ransomware precursor behavior such as mass file discovery, credential dumping tools, backup deletion, or shadow copy deletion.

• {.exec|
• {.save|
• {.load|
• {.set|
• %7B.exec%7C
• %7b.exec%7c
• %7B.save%7C
• %7B.load%7C
• %00{.
• hfs.exe -> cmd.exe
• hfs.exe -> powershell.exe
• hfs.exe -> certutil.exe
• hfs.exe -> bitsadmin.exe
• hfs.exe -> wscript.exe
• hfs.exe -> cscript.exe
• hfs.exe -> mshta.exe
• hfs.exe -> curl.exe
• hfs.exe -> wget.exe
• cmd.exe /c powershell
• powershell -enc
• powershell -encodedcommand
• certutil -urlcache
• bitsadmin /transfer
• Invoke-WebRequest
• Start-BitsTransfer
• vssadmin delete shadows
• wmic shadowcopy delete
• bcdedit /set {default} recoveryenabled no
• schtasks /create
• New-Service

What your security team should do

• Immediately identify all Rejetto HFS 2.3m and earlier deployments, prioritizing internet-exposed instances.
• Retire or replace vulnerable HFS 2.x servers; do not treat unsupported 2.3m as sustainably patchable.
• If exposure existed, initiate compromise assessment before redeploying or migrating the service.
• Block public access immediately while remediation is underway; require VPN, source allowlisting, or authenticated reverse proxy access.
• Add WAF/reverse-proxy detections for HFS macro delimiters and command-execution keywords in HTTP request paths and query strings.
• Hunt endpoint telemetry for hfs.exe spawning cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe, wscript.exe, cscript.exe, mshta.exe, curl.exe, or wget.exe.
• Review HFS, web proxy, firewall, EDR, PowerShell, Windows Security, and Sysmon logs for exploitation attempts and post-exploitation activity.
• Rotate credentials, tokens, and secrets stored on or accessible from any exposed HFS host.
• Segment file-sharing servers from domain controllers, backup infrastructure, and sensitive internal systems.
• Escalate remediation urgency due to KEV listing, ransomware association, active exploitation, very high EPSS probability, and the missed CISA due date.