CVE-2024-23692

Imagine leaving your office's filing cabinet unlocked and open to the street, with a sign saying anyone can walk in, grab files, and even rearrange the furniture — that's what this flaw does to a computer running this file-sharing software. An attacker doesn't need a password or any trick to get in; they can send a single crafted request and take over the machine completely, which is exactly how ransomware gangs have been using it.

This matters to you if your business uses Rejetto HTTP File Server (HFS), particularly version 2.3m or earlier, to share files over a network. It affects you regardless of whether you set a login, since the attack requires no credentials at all — the main question is only whether the server is reachable from the internet.

Attackers are already exploiting this flaw in active ransomware campaigns, and CISA has confirmed real-world attacks and ordered federal agencies to remediate by July 30, 2024. Given the product is no longer supported and public exploit tools are freely available, this is a critical, immediate-action situation — do not wait.

Confirm exposure by checking for running instances of Rejetto HTTP File Server, version 2.3m or earlier, and verify whether the service is exposed to the internet (check firewall rules, port forwarding, cloud security groups). No fixed version exists — the vendor has ended support for the 2.x branch, so there is no official patch to upgrade to. Recommended path: decommission HFS entirely and migrate to a supported alternative (e.g., a maintained file-transfer solution). If immediate decommission isn't possible, apply a temporary workaround: remove internet exposure, restrict access via firewall/VPN to trusted internal IPs only, and disable the web interface if not actively needed. Monitor for indicators of compromise: unexpected child processes spawned by the HFS process, new local admin accounts, unusual outbound connections, or ransomware artifacts, since this CWE-1336 template-injection flaw (chained to CWE-94 code execution) is actively weaponized with public PoCs (including a Metasploit module) and listed in CISA KEV with ransomware use. CISA remediation due date for federal systems was 2024-07-30; private organizations should treat this with equal urgency given sustained exploitation and press attention.

CVSS 9.8 (Critical), AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — fully remote, no privileges or user interaction required, full compromise of confidentiality, integrity and availability. Root cause is a server-side template injection (CWE-1336) that enables remote code execution (CWE-94) in Rejetto HFS ≤2.3m. Confirmed active exploitation: CISA KEV entry added 2024-07-09 citing ransomware campaign use, overriding the EPSS prediction (which independently sits at the 100th percentile, rising). Exploit maturity is high: 5+ public PoCs on GitHub and an integrated Metasploit module (rapid7/metasploit-framework PR #19240). No vendor patch exists as the 2.x branch is end-of-life; remediation requires migration or network isolation rather than version upgrade.