CVE-2024-23692 Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine

Exploited in the wild Critical 9.8 Published 31 May 2024 Updated 11 Aug 2026

Remote unauthenticated attackers can execute arbitrary commands via template injection in Rejetto HTTP File Server, which is now end-of-life.

Exploited in the wild: Since 9 Jul 2024
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-23692?

CVE-2024-23692 is a critical code injection vulnerability in Rejetto HTTP File Server, published on 31 May 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.

Weakness: CWE-94, CWE-1336

Which versions are affected by CVE-2024-23692?

It affects 1 product.

Products include Rejetto Http File Server.

How do I fix CVE-2024-23692?

No fix has been published for CVE-2024-23692 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 30 Jul 2024.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2024-23692 being exploited?

Yes. Attackers have exploited CVE-2024-23692 in the wild since at least 9 Jul 2024, including in ransomware campaigns.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 14 proofs of concept on GitHub.

Sources

Also known as GHSA-cw5c-xm7f-wx63.