wgetnz/hfs2CVE-2024-23692 | HFS 2.3m/2.4-RC07 RCE vulnerability fix
You can use HFS (HTTP File Server) to send and receive files. It's different from classic file sharing because it uses web technology. It also differs from classic web servers because it's very easy to use and runs "right out-of-the box".
The virtual file system will allow you to easily share even one single file.
| Item | Content |
|---|
| CVE ID | CVE-2024-23692 |
| Affected Versions | HFS 2.3m, HFS 2.4.0 RC07 and below |
| Vulnerability Type | Unauthenticated Remote Code Execution (Unauthenticated RCE) |
| CVSS Score | 9.8 Critical |
| Attack Vector | Network reachable, no authentication required, no user interaction |
HFS's template engine, when handling the {.?search.} macro (reading URL query parameters), recursively calls applyMacrosAndSymbols2() on the return value, causing user-controlled strings to be executed as template code.
The attack chain consists of four steps:
1. Construct a search parameter containing %url%
↓
2. %url% expands to macroQuote(full URL) = {:url_including_payload:}
↓
3. %password% expands to an empty string, causing the {:...:} quote block to close prematurely
↓
4. {.exec|cmd.} outside the quote block is executed by the macro engine → RCE
POC Example (for security research only):
GET /?n=%0A&cmd=whoami&search=%25xxx%25url%25:%password%}{.exec|{.?cmd.}|timeout=15|out=abc.}{.?n.}{.?n.}RESULT:{.?n.}{.^abc.}===={.?n.} HTTP/1.1
Fixed file: scriptLib.pas
Core function: noMacrosAllowed() (lines 109–123)
function noMacrosAllowed(s:string):string;
// prevent hack attempts
begin
// Step 1: Replace the first character of all macro markers with HTML entities
// {. → {. .} → .}
// {: → {: :} → :}
// | → |
repeat
i := findMacroMarker(s, i);
if i = 0 then break;
replace(s, '&#' + intToStr(charToUnicode(s[i])) + ';', i, i);
until false;
// Step 2: Replace %symbol%-style symbol references with HTML entities
// %url% → %url%
// %password% → %password%
s := reReplace(s, '%([-a-z0-9]+)%', '%$1%', 'mi');
result := s;
end;
Call locations: All user-controlled inputs pass through this function before being returned to the template engine:
| Call Location | Protection Scope |
|---|---|
urlVar() line 548 | All URL query parameters {.?name.} |
| Line 698 | Template variable reads |
| Line 1549 | Cookie values |
| Line 2089 | URL decoded values |
| Line 2165 | HTTP request headers |
| Line 2173 | POST form parameters |
Remediation effect: After processing, all macro markers and symbol references in the POC's search parameter are HTML-entity-encoded, preventing them from triggering the macro engine.
Initially developed in 2002 with Delphi 6, now with Delphi 10.3.3 (Community Edition). Icons are generated at http://fontello.com/ . Use fontello.json for further modifications.
For the default template we are targeting compatibility with Chrome 49 as it's the latest version running on Windows XP.