{"id":"CVE-2024-23692","published":"2024-05-31T10:15:09Z","modified":"2026-08-11T04:17:15Z","title":"Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability","vendor":"Rejetto","product":"HTTP File Server","tier":"core","eol":null,"description":{"text":"Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.","provenance":"source","from":"NVD"},"summary":{"text":"A template injection flaw in Rejetto HTTP File Server, affecting versions up to and including 2.3m, lets its template engine process attacker-supplied input as code. An remote, unauthenticated attacker needs only network access to the server and can send a specially crafted HTTP request, with no user interaction or special configuration required, to execute arbitrary commands on the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:40Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99485,"percentile":0.99944,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-07-09","dueDate":"2024-07-30","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"The patched Rejetto HTTP File Server (HFS) is version 3: https://github.com/rejetto/hfs?tab=readme-ov-file#installation, https://www.rejetto.com/hfs/ ;   https://nvd.nist.gov/vuln/detail/CVE-2024-23692","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-06-28","exploitedFirstSeen":"2024-06-28","ransomware":true,"evidence":[{"url":"https://asec.ahnlab.com/ko/67509/","date":"2024-06-28"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-07-09"},{"url":"https://cert.gov.ua/article/6280129","date":"2024-07-21"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/sensor-intel-series-top-cves-august-2024","date":"2024-09-19"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-13&host_type=src&vulnerability=cve-2024-23692","date":"2024-11-13"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-14&host_type=src&vulnerability=cve-2024-23692","date":"2024-11-14"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-17&host_type=src&vulnerability=cve-2024-23692","date":"2024-11-17"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-20&host_type=src&vulnerability=cve-2024-23692","date":"2024-11-20"},{"url":"https://go.recordedfuture.com/hubfs/reports/CTA-RU-2024-1121.pdf","date":"2024-11-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-11-25&host_type=src&vulnerability=cve-2024-23692","date":"2024-11-25"}],"evidenceTotal":380,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"},{"id":"CWE-1336","name":"Improper Neutralization of Special Elements Used in a Template Engine"}],"references":[{"url":"https://github.com/rapid7/metasploit-framework/pull/19240","tags":["Exploit","Issue Tracking","Patch"]},{"url":"https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce/","tags":["Exploit"]},{"url":"https://vulncheck.com/advisories/rejetto-unauth-rce","tags":["Third Party Advisory"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/19240","tags":["Exploit","Issue Tracking","Patch"]},{"url":"https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce/","tags":["Exploit"]},{"url":"https://vulncheck.com/advisories/rejetto-unauth-rce","tags":["Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2024-23692-detect-rejetto-hfs-vulnerability","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/cve-2024-23692-rejetto-hfs-mitigate-vulnerability","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.vicarius.io/vsociety/posts/unauthenticated-rce-flaw-in-rejetto-http-file-server-cve-2024-23692","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23692","tags":["US Government Resource"]}],"techniques":[{"id":"T1221","name":"Template Injection","tactics":["stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data. ","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1082","name":"System Information Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"primary_impact","evidence":[],"comment":"CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"},{"id":"T1496","name":"Resource Hijacking","tactics":["impact"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Other","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data. ","confidence":"medium","confidenceNote":"CTID KEV capability group \"other\" is generic"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-21153","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-21153","exploited":true,"exploitedSince":"2024-07-09","provenance":"source"},"exploits":[{"id":52102,"url":"https://www.exploit-db.com/exploits/52102","title":"Rejetto HTTP File Server 2.3m - Remote Code Execution (RCE)","type":"webapps","platform":"typescript","date":"2025-03-28","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-03-28"},"pocGithub":{"count":12,"skipped":2,"earliest":"2024-06-11","earliestUrl":"https://github.com/NanoWraith/CVE-2024-23692","repos":[{"name":"verylazytech/CVE-2024-23692","url":"https://github.com/verylazytech/CVE-2024-23692","stars":51,"created":"2024-09-15"},{"name":"jakabakos/CVE-2024-23692-RCE-in-Rejetto-HFS","url":"https://github.com/jakabakos/CVE-2024-23692-RCE-in-Rejetto-HFS","stars":17,"created":"2024-06-13"},{"name":"0x20c/CVE-2024-23692-EXP","url":"https://github.com/0x20c/CVE-2024-23692-EXP","stars":15,"created":"2024-06-18"},{"name":"vanboomqi/CVE-2024-23692","url":"https://github.com/vanboomqi/CVE-2024-23692","stars":12,"created":"2024-06-13"},{"name":"BBD-YZZ/CVE-2024-23692","url":"https://github.com/BBD-YZZ/CVE-2024-23692","stars":7,"created":"2024-06-17"}]},"metasploit":[{"name":"Rejetto HTTP File Server (HFS) Unauthenticated Remote Code Execution","module":"exploit/windows/http/rejetto_hfs_rce_cve_2024_23692","type":"exploit","disclosureDate":"2024-05-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/rejetto_hfs_rce_cve_2024_23692.rb"}],"nuclei":[{"id":"CVE-2024-23692","name":"Rejetto HTTP File Server - Template injection","severity":"critical","path":"http/cves/2024/CVE-2024-23692.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-23692.yaml"}],"first":{"date":"2024-05-25","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/rejetto_hfs_rce_cve_2024_23692.rb"},"provenance":"source"},"exploitRefs":["https://github.com/rapid7/metasploit-framework/pull/19240","https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce/","https://www.vicarius.io/vsociety/posts/cve-2024-23692-detect-rejetto-hfs-vulnerability","https://www.vicarius.io/vsociety/posts/cve-2024-23692-rejetto-hfs-mitigate-vulnerability","https://www.vicarius.io/vsociety/posts/unauthenticated-rce-flaw-in-rejetto-http-file-server-cve-2024-23692"],"flow":[{"stage":"primary","techniques":["T1082"],"provenance":"source"},{"stage":"secondary","techniques":["T1005","T1105","T1496"],"provenance":"source"},{"stage":"related","techniques":["T1221"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2024-05-25","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2024-06-11, Exploit-DB 2025-03-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/rejetto_hfs_rce_cve_2024_23692.rb","provenance":"source"},{"date":"2024-05-31","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23692","provenance":"source"},{"date":"2024-06-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://asec.ahnlab.com/ko/67509/","provenance":"source"},{"date":"2024-07-09","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-07-09","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-21153","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":39},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 854 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9994"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"5 NVD references tagged Exploit; 1 Exploit-DB entry; 12 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}