CVE-2024-39943
Critical
Description
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
SeverityCritical
CVSS9.9
Exploit probability—
ProductRejetto Http File Server
PublishedJul 4, 2024
First seenJul 4, 2024
Weakness typeCWE-284Improper access control
How to fix
Update
- rejetto http_file_server0.52.10 or later
- hfs0.52.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rejetto http_file_server | v < 0.52.10 | 0.52.10 |
| hfsnpm | v < 0.52.10 | 0.52.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.