CVE-2014-6287 Rejetto HTTP File Server (HFS) Remote Code Execution

Exploited in the wild Critical 9.8 Published 7 Oct 2014 Updated 22 Oct 2025

Remote attackers can execute arbitrary programs on Rejetto HTTP File Server by injecting null bytes into search actions.

Exploited in the wild: Since 25 Mar 2022
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2014-6287?

CVE-2014-6287 is a critical code injection vulnerability in n/a, published on 7 Oct 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.

Weakness: CWE-94

Which versions are affected by CVE-2014-6287?

It affects 1 product.

Products include Rejetto Http File Server.

How do I fix CVE-2014-6287?

No fix has been published for CVE-2014-6287 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 15 Apr 2022.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2014-6287 being exploited?

Yes. Attackers have exploited CVE-2014-6287 in the wild since at least 25 Mar 2022.

Public exploit code: 1 Metasploit module, 4 Exploit-DB entries, 1 Nuclei template and 13 proofs of concept on GitHub.

Sources

Also known as GHSA-2hx5-63mq-crfj.