Security researchers have observed active scanning and exploitation attempts targeting a critical remote code execution (RCE) vulnerability in Rejetto HTTP File Server (HFS). Tracked as CVE-2024-23692, this template injection flaw allows unauthenticated attackers to execute arbitrary commands on vulnerable servers by sending a specially crafted HTTP request.
The vulnerability affects Rejetto HFS version 2.3m and earlier. Given the wide use of HFS for file sharing, organizations are urged to update to version 2.4 or migrate to the rewritten HFS 3.0 to mitigate the risk of full system compromise and potential malware deployment.
Top comments (0)