HFS 2.x Unauthenticated RCE via Multipart Filename Template Injection

Unauthenticated RCE in HFS 2.x via multipart Upload Filename Template Injection Vulnerability Overview Vulnerability Type: Unauthenticated Remote Code Execution (RCE) Vulnerability Mechanism: When handling multipart uploads, HFS 2.x writes the filename into the server-side template symbol mapping as the symbol. However, it fails to apply and escaping, unlike the and fields which are properly escaped. Additionally, the template engine's function performs sequential global replacements. If the current filename contains the text , the value undergoes secondary replacement. An attacker can exploit this to disguise an unescaped expression. The character within this value triggers the template engine's reference region, causing the subsequent macro to be injected into the macro dispatcher. Since the attacker does not perform any authentication checks on this branch, arbitrary system commands are executed with the privileges of the HFS process. This can be triggered by a single HTTP request without authentication. Differences from CVE-2024-23692: Entry Point: CVE-2024-23692 utilizes the request query parameter; this vulnerability utilizes the multipart upload filename. Escape Technique: CVE-2024-23692 relies on plus the macro to abbreviate into ; this vulnerability relies on the filename containing to trigger a secondary replacement, where directly terminates the reference region. Unescaped Destination: CVE-2024-23692 targets the / symbol path; this vulnerability targets the field in . Affected Versions: CVE-2024-23692 affects versions ( ); this vulnerability affects 2.4.0 RC7, which is outside the scope of the aforementioned versions. Impact Scope Affected Versions: 2.4.0 RC7 (build 319, verified); the entire 2.4 series (v2.4-alpha87 ~ v2.4-rc07) and the source code for 2.4.0 RC8 in the master branch. CVSS v3.1: 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) CVSS v4.0: 9.3 Critical (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N) Authentication Requirements: None required; no session, no user interaction needed. Remediation Temporary Mitigation Do not expose HFS 2.x to untrusted networks; restrict listeners to trusted internal networks or VPNs. Filter the , , , and characters from the multipart parameter at the reverse proxy layer. Run HFS under a low-privilege user account that lacks the capability to execute commands. If upload functionality is not needed, disable all unauthenticated anonymous verification checks — note that this only provides mitigation, as the injection occurs during the rendering of upload failure messages and does not require a successful upload. Root Cause Fix 1. Apply escaping at a unified security boundary to isolate template filenames: - In the function within , change the field to . - It is also recommended to apply (or an equivalent encoder) to all fields derived from / filenames in , not just . 2. Ensure that replacement results from do not participate in subsequent matches, preventing injected values from being scanned again as symbol names: - In the function within , change to . 3. Introduce an authentication model for the macro dispatcher to prevent privileged branches from being triggered without the necessary capabilities: - In , add an check before the branch. If the check fails, execute . Verification of Fix Replay of the PoC should result in no command oracle and no command output; the filename should appear in its literal escaped form (e.g., ) rather than as an expanded macro. Use for regression testing by replaying the attack. POC Code 4.1 Template Evaluation Oracle Response: ```http HTTP/1.1 200 OK [ { "err":"Not allowed.", "name":"kItem-resource700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000

Goal Reached Thanks to every supporter — we hit 100%!

HFS 2.x Unauthenticated RCE via Multipart Filename Template Injection

More from this source