Rejetto HFS 2.x Macro Authorization Bypass: Arbitrary File Read/Write/Delete via Path Traversal

HFS 2.x Template File Macro Authorization Bypass Vulnerability Summary Vulnerability Overview Vulnerability Name: HFS 2.x Template File Macro Authorization Bypass - Unauthorized Arbitrary File Read/Write/Delete Vulnerability Type: Missing Authorization leading to Arbitrary File Read/Write/Append/Delete (outside of shared directories) CVSS Score: 9.8 (Critical) Cause: In HFS 2.4.0 RC7, privileged file operations were implemented as template macros, but no authorization checks are performed on the caller upon distribution. Additionally, the path resolution function returns the argument unchanged if the path does not contain a forward slash, allowing attackers to construct absolute paths (e.g., ) to bypass virtual file system restrictions. Impact Scope Affected Product: Rejetto HTTP File Server (HFS) 2.x Affected Versions: 2.4.0 RC7 (Build 319); empirically tested across the full 2.4 series and the 2.4.0 RC9 source code on the master branch. Environment Requirements: Windows 10 x64 / Default Configuration / Running under a non-privileged account. Remediation 1. Temporary Mitigation: Do not expose HFS 2.x to untrusted networks. Run HFS under an account with minimal privileges and restrict its file system permissions. If the template does not require / , remove the relevant sections directly. Migrate to HFS 3.x. 2. Permanent Fix: Authorization: Add actual authorization gates (e.g., ) to each privileged macro branch. Path Normalization: Validate and normalize paths at the destination, rejecting absolute paths and directory traversal sequences, and parsing them using a normalization algorithm. POC Code / Exploit Code 1. Existence Oracle for Files Outside Shared Directories 2. Arbitrary File Read (Read-Only, Core Proof) 3. Arbitrary File Write / Append / Delete (Canary Self-Cleanup) Create: Read Back: Append: Delete: Confirm Deletion: 4. PoC Usage

Goal Reached Thanks to every supporter — we hit 100%!

Rejetto HFS 2.x Macro Authorization Bypass: Arbitrary File Read/Write/Delete via Path Traversal

More from this source