CVE-2024-39943 rejetto HFS vulnerable to OS Command Execution by remote authenticated users
Remote authenticated users with upload permissions can execute OS commands via shell execution of df in HFS.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-39943?
CVE-2024-39943 is a critical command injection vulnerability in n/a, published on 4 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
Which versions are affected by CVE-2024-39943?
2 open source packages ship an affected version, including hfs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
hfs npm | All versions | 0.52.10 |
hfs npm | All versions | 0.52.10 |
Products include Rejetto Http File Server.
How do I fix CVE-2024-39943?
Upgrade hfs to 0.52.10 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-39943 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-39943 exists.
Public exploit code: 2 proofs of concept on GitHub.
Other vulnerabilities in n/a
Sources
Also known as GHSA-5f4x-hwv2-w9w2.