Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability (CVE-2014-6287)

What is affected, what to do

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.

The vulnerability is being actively exploited; treat it as a priority. Update Rejetto Http File Server to version 2.3c. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Rejetto Http File Server lt 2.3..2.3c

Fixed in

• Rejetto Http File Server 2.3c

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Upgrade every Rejetto HFS instance to version 2.3c or later. All 2.3x versions before 2.3c are vulnerable; the flaw lives in findMacroMarker in parserLib.pas and triggers on a %00 null-byte sequence inside the search action.
   • If upgrading is not possible right now: stop the HFS service (net stop or kill the process) or at minimum block its HTTP listener (default TCP/80, often TCP/8080) at both the perimeter firewall and the local Windows Defender firewall.
   • Audit internet exposure: scan your own ASN ranges for open HFS instances (HTTP header Server: HFS 2.3x) and isolate hits immediately.
   • Host triage: HFS typically runs as hfs.exe under a non-hardened user context — inspect process tree, scheduled tasks, Autoruns entries and Temp directories for foreign binaries (coinminers, remote-access tools).
   • Because HFS is mostly used for ad-hoc file sharing: identify the business owner and evaluate replacement with hardened alternatives (SMB over VPN, Nextcloud, SFTP). The 2.3 code line is effectively unmaintained.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: never place HFS directly on the internet or on flat office VLANs. Front it with a reverse proxy that enforces authentication (nginx/Apache with Basic Auth plus rate limiting) or require a TLS VPN.
   • WAF/IPS rule: block requests containing a URL-encoded null byte (%00, %2500) in query parameters — in particular paths involving search, ?search= or HFS macro syntax such as {.exec.} / {.save.}. Emerging Threats ships Snort/Suricata rules for CVE-2014-6287 (SID range 2019409 and following).
   • Endpoint hardening: run the HFS process under a dedicated non-privileged service account and use Software Restriction Policies / WDAC to forbid hfs.exe from spawning child processes such as cmd.exe, powershell.exe, cscript.exe, mshta.exe.
   • Egress filtering: block outbound connections from the HFS host to Pastebin, raw GitHub, known downloader CDNs and Monero mining pools — typical post-exploitation payloads pull second-stage components.
   • Configuration hardening: in the HFS UI disable all macros (exec, save, load), set the virtual file system to read-only, and bind the admin interface to 127.0.0.1.
   • Perimeter monitoring: sweep internal networks regularly (Nmap http-headers) for the default Server: HFS 2.3 banner to surface shadow-IT instances.
3. 03

   Runbook step 3

   Detection rules

   • Web access log / reverse proxy: match search=%00 or search=.*%2500.* plus HFS macro markers {.exec|.save|.load} in GET/POST parameters. KQL shape: WebLog | where UriQuery contains "%00" and UserAgent !contains "healthcheck".
   • Sysmon EID 1 (Process Create): ParentImage ends with \hfs.exe and Image is cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe, regsvr32.exe or certutil.exe — a direct exploitation indicator.
   • Sysmon EID 3 / Zeek conn.log: outbound connections from hfs.exe to external IPs on atypical ports (anything beyond vendor update endpoints), especially TCP to Pastebin-like hosts or mining pool ports (3333, 5555, 7777).
   • Windows Security EID 4688 (where Sysmon is absent): enable command-line logging and alert on CommandLine containing powershell -nop -w hidden -enc with parent process hfs.exe.
   • Sigma shape: detection: selection: ParentImage|endswith: '\hfs.exe'; Image|endswith: ['\cmd.exe','\powershell.exe','\certutil.exe']; condition: selection — portable to Elastic, Splunk and Sentinel.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.

Source: NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE)

Vendors and products

• Rejetto Rejetto Http File Server

References & sources

• kb.cert.orgVU#251276Third-party advisory, x_refsource_CERT-VN, Third-party advisory, US government resource
• exploit-db.com39161Exploit, x_refsource_EXPLOIT-DB, Exploit, Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/128243/HttpFileServer-2.3.x-Remote-Command-Execution.htmlx_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• github.comrapid7/metasploit-framework/pull/3793x_refsource_MISC, Exploit
• packetstormsecurity.comfiles/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Executi…x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execut…x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• packetstormsecurity.comfiles/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.h…x_refsource_MISC, Exploit, Third-party advisory, Vulnerability database
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6287government-resource, US government resource