Rejetto HTTP File Server (HFS) Unauthorized RCE Vulnerability Reproduction (CVE-2024-23692)

Introduction

Rejetto HTTP File Server (HFS) is a lightweight HTTP file server widely used for file sharing and file transfer. CVE-2024-23692 is a template injection vulnerability that allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending specially crafted HTTP requests. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.

Vulnerability Details

• CVE ID: CVE-2024-23692
• Vulnerability Type: Template injection vulnerability, Remote Code Execution (RCE)
• Affected Versions: Rejetto HTTP File Server 2.3m and prior
• Vulnerability Description: This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending specially crafted HTTP requests.

Exploit Reproduction

Environment Setup

1. Install Rejetto HTTP File Server:
   • Visit the Rejetto official website to download and install HFS.
2. Start the HFS Service:
   • Start HFS and set up an appropriate file sharing directory.

Exploitation Tool

We provide a Python script to exploit this vulnerability. Ensure the following dependencies are installed:

• argparse
• http.client
• urllib.parse
• pathlib
• concurrent.futures

Usage Instructions

1. Clone or Download the Script:
   • Save the provided Python script as exploit.py.
2. Single URL Exploitation:
   root@kitploit:~

   python exploit.py -url http://example.com:8080 -cmd "whoami"
   

Parameter Description:

• -url: Target URL.
• -cmd: Command to execute (default: whoami).
• -o: File to save successful results (default: output.txt). Batch URL Exploitation:

Create a text file containing multiple URLs, e.g., urls.txt, one URL per line.

python exploit.py -r urls.txt -cmd "whoami" -o results.txt

Notes

• Ensure the target URL uses a valid HTTP or HTTPS protocol.
• Ensure you have obtained legitimate authorization when using this script.
• This script is intended for security research and legitimate penetration testing only.