Rejetto HTTP File Server 2.3m Unauthenticated RCE (CVE-2024-23692)

What is affected, what to do

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Rejetto HTTP File Server lte *..2.3m

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Take every Rejetto HFS 2.3m instance (and any older 2.x build) offline immediately — the 2.x branch is end-of-life, no vendor patch will be issued.
   • Plan and test migration to the actively maintained HFS 3.x line (github.com/rejetto/hfs); until the cutover, move affected hosts into an isolated VLAN with no inbound internet exposure.
   • Perimeter firewall change: block inbound TCP 80/8080 (or whichever port the HFS listener is bound to) from the internet to affected hosts; apply tight egress filtering outbound from these hosts to kill reverse shells.
   • Rotate credentials on every host running HFS: local admin passwords, service accounts, cached browser credentials, SSH keys. Unauthenticated RCE as SYSTEM/Administrator must be treated as full host compromise.
   • Triage the HFS hosts now: inspect the hfs.exe process tree (child processes such as cmd.exe, powershell.exe, mshta.exe, certutil.exe, curl.exe are strong IoCs); if hits are found, image the host for forensics before rebuild.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: HFS must not be reachable from the DMZ or internet. Where business-critical, front it with an nginx or HAProxy reverse proxy enforcing a URL allowlist and dropping requests that contain template metacharacters ({., }}, %7b, %7d) in the request line or query string.
   • WAF/IPS rules: drop HTTP requests containing {.exec|, {.?exec, {.add|, {.set| or their URL-encoded forms (%7B.exec%7C) in URI or body. Suricata/Snort signatures for CVE-2024-23692 ship in ET Open; run them in blocking mode, not just alert.
   • Endpoint hardening: run the HFS process under a dedicated unprivileged local account (not SYSTEM, not Administrator). Add an AppLocker/WDAC rule that prevents hfs.exe from spawning interpreters (cmd, powershell, wscript, cscript, bitsadmin).
   • File-system layer: set upload directories read-only where possible; otherwise strip execute permissions via NTFS ACLs and enable AV on-access scanning on the upload path.
   • IAM: expose the HFS admin interface only over VPN with MFA; disable default credentials and anonymous access in HFS configuration even though the exploit itself needs no auth — this limits post-exploitation lateral movement.
3. 03

   Runbook step 3

   Detection rules

   • Sysmon Event ID 1 (Process Creation) with ParentImage ending in \hfs.exe and ChildImage in (cmd.exe, powershell.exe, mshta.exe, rundll32.exe, certutil.exe, bitsadmin.exe, curl.exe, wget.exe) — treat as alert, not just log.
   • Web / reverse-proxy access logs: search for GET /?search=%7B.exec, {.exec|, {.?add, {.set|, and long base64-looking query strings immediately after exec|. KQL shape: W3CIISLog | where csUriQuery has_any ("{.exec", "%7B.exec", "{.?add", "{.set|").
   • Network telemetry (Zeek http.log, Suricata): correlate URIs containing template delimiters with user agents such as curl/, python-requests/, empty UA, or known scanner fingerprints (Nuclei, zgrab).
   • EDR process chains: HFS → PowerShell with -nop, -w hidden, -enc flags, or HFS → any process initiating outbound connections to 4444/1337/9999 (default reverse-shell ports in the public PoCs).
   • Windows Security Event ID 4688 / 4624: unexpected logons shortly after HFS activity, plus new local accounts. On Linux auditd: execve with comm=hfs referencing /bin/sh in argv.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.

Source: pwn.watch, CISA KEV Catalog, cvelistv5, NVD (NIST), CVE.org (MITRE)

Vendors and products

• Rejetto Rejetto Http File Server

Weakness classes (CWE)

• CWE-1336Improper Neutralization of Special Elements Used in a Template Engine

  Base

  The product uses a template engine to insert or process externally-influenced input, but it does not neutralize or incorrectly neutralizes special elements or syntax that can be interpreted as template expressions or other code directives when processed by the engine.

  Entry at MITRE CWE-1336

References & sources

• vulncheck.comadvisories/rejetto-unauth-rceThird-party advisory
• mohemiv.comall/rejetto-http-file-server-2-3m-unauthenticated-rceThird-party advisory, Technical description
• github.comrapid7/metasploit-framework/pull/19240Issue tracking
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23692government-resource
• vicarius.iovsociety/posts/unauthenticated-rce-flaw-in-rejetto-http-file-se…
• vicarius.iovsociety/posts/cve-2024-23692-detect-rejetto-hfs-vulnerability
• vicarius.iovsociety/posts/cve-2024-23692-rejetto-hfs-mitigate-vulnerability
• pwn.watchpwn.watch: Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Enginepwn-watch
• github.comRejetto advisory: CVE-2024-23692pwn-watch
• rejetto.comRejetto advisory: CVE-2024-23692pwn-watch
• NVD (NIST)NVD: CVE-2024-23692pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

1. CVE Modified11.08.2026134c704f-9b21-4f2e-91b3-4a467353bcc0

   • SSVC: before {"id":"CVE-2024-23692","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic… after {"id":"CVE-2024-23692","role":"CISA Coordinator","options":[{"exploitation":"active"},{"automatable":"yes"},{"technic…