CVE-2024-23692 PoC — Rejetto HTTP File Server 2.3m Unauthenticated RCE

Source

https://github.com/NingXin2002/HFS2.3_poc

Associated Vulnerability

Title: Rejetto HTTP File Server 2.3m Unauthenticated RCE (CVE-2024-23692)
Description:Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.

Description

HFS2.3未经身份验证的远程代码执行(CVE-2024-23692)

Readme

# HFS2.3_poc
HFS2.3未经身份验证的远程代码执行(CVE-2024-23692)

python HFS2.3_poc.py -h                             

                ) (`-.            ) (`-.
         ( OO ).           ( OO ).
        (_/.  \_)-. ,-.-')(_/.  \_)-. ,-.-')
         \  `.'  /  |  |OO)\  `.'  /  |  |OO)
          \     /\  |  |  \ \     /\  |  |  \
           \   \ |  |  |(_/  \   \ |  |  |(_/
          .'    \_),|  |_.' .'    \_),|  |_.'
         /  .'.  \(_|  |   /  .'.  \(_|  |
        '--'   '--' `--'  '--'   '--' `--'


usage: HFS2.3_poc.py [-h] [-u URL] [-f FILE]  

HFS2.3未经身份验证的远程代码执行(CVE-2024-23692)  

optional arguments:  
  -h, --help            show this help message and exit  
  -u URL, --url URL     添加url信息  
  -f FILE, --file FILE  添加txt文件  

example:  
    python3 HFS2.3_poc.py -u http://xxxx.xxxx.xxxx.xxxx  
    python3 HFS2.3_poc.py -f x_url.txt

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →