by Kastro
Paper/Archive/CVE-2024-39943

CVE-2024-39943

rejetto http_file_server — rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (…

EPSS 39%public exploitCVSS 9.9
critical.is priorityof 100
59
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 98.6.986 × 2019.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).

Affected

ProductAffectedFixed inSource
n/an/a–CNA
http_file_server< 0.52.100.52.10CISA-ADP

Scores by source

mitre (CNA)9.9CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refrejetto.com/wiki/index.php/HFS:_Working_with_uploadsrefgithub.com/rejetto/hfs/commit/305381bd36eee074fb238b64302a252668daad1drefgithub.com/rejetto/hfs/compare/v0.52.9...v0.52.10