CVE-2014-6287criticalunder attackCWE-94

CVE-2014-6287

Published · Updated

Follow this CVE+ Monitor HTTP File Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 99%
from disclosure to weaponsame day
Published on NVDOct 7
1st PoCSep 15
metasploitSep 11
CISA KEV+2726d
Action required by CISAfederal deadline: 2022-04-15

Apply updates per vendor instructions.

In short

Rejetto HTTP File Server has a flaw in its search feature that allows attackers to run any program on the server by inserting a special character sequence. This is critical because it gives complete control of the affected server to an attacker.

Technical detail

The findMacroMarker function in parserLib.pas fails to properly validate null byte (%00) sequences in search parameters, allowing remote code execution through macro injection. An unauthenticated attacker can exploit the search action endpoint to inject and execute arbitrary commands with server privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
public PoCs found — 38✓ VexDay Proof
exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34668exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/39161exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/34926exploitdbwww.exploit-db.com/exploits/49125unverifiedgithubgithub.com/randallbanner/Rejetto-HTTP-File-Server-HFS-2.3.x---Remote-Command-Execution★ 2githubgithub.com/mrintern/thm_steelmountain_CVE-2014-6287★ 1githubgithub.com/Nicoslo/Windows-exploitation-Rejetto-HTTP-File-Server-HFS-2.3.x-CVE-2014-6287★ 1githubgithub.com/roughiz/cve-2014-6287.py★ 0githubgithub.com/wizardy0ga/THM-Steel_Mountain-CVE-2014-6287★ 0githubgithub.com/rahisec/rejetto-http-file-server-2.3.x-RCE-exploit-CVE-2014-6287★ 0githubgithub.com/nika0x38/CVE-2014-6287★ 0githubgithub.com/JoaZ94/rejjeto_hfs-rce-exploit-cve-2014-6287★ 0githubgithub.com/jagg3rsec/CVE-2014-6287★ 0githubgithub.com/R3fr4kt/Optimum★ 0githubgithub.com/10cks/CVE-2014-6287★ 0githubgithub.com/Z3R0space/CVE-2014-6287★ 0githubgithub.com/francescobrina/hfs-cve-2014-6287-exploit★ 0githubgithub.com/zhsh9/CVE-2014-6287★ 0cve_referencepacketstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/ca60bce877c0unverifiedvulncheckvulncheck.com/xdb/f047fc0fbb05unverifiedcve_referencepacketstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execution.htmlunverifiedvulncheckvulncheck.com/xdb/819a4221c19eunverifiedvulncheckvulncheck.com/xdb/5a7c8f3319f2unverifiedvulncheckvulncheck.com/xdb/d3f707772d31unverifiedvulncheckvulncheck.com/xdb/7e75a52fb2c4unverifiedvulncheckvulncheck.com/xdb/ac9a55de5631unverifiedvulncheckvulncheck.com/xdb/87218ce82812unverifiedvulncheckvulncheck.com/xdb/95b99733114bunverifiedvulncheckvulncheck.com/xdb/561648cf3450unverifiedvulncheckvulncheck.com/xdb/ab1b8c027b00unverifiedvulncheckvulncheck.com/xdb/9687fe1980c1unverifiedvulncheckvulncheck.com/xdb/00c8dc7170a4unverifiedvulncheckvulncheck.com/xdb/8ec68bc5f629unverifiedvulncheckvulncheck.com/xdb/112c9c9f9dc8unverifiedcve_referencewww.exploit-db.com/exploits/39161/unverifiedcve_referencepacketstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Execution.htmlunverified
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.