CVE-2024-39943
CRITICALrejetto HFS < 0.52.10 - Authenticated OS Command Injection via df Command Execution
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2024-39943. PoCs published by JenmrR, Heyholiday067.
AI-analyzed exploit summary This repository contains a functional exploit PoC for CVE-2024-39943, demonstrating a Remote Command Execution (RCE) vulnerability in a Node.js-based HFS server. The exploit leverages a file upload feature that executes the uploaded file's content as a system command using `child_process.execSync()`.
Description
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
Exploits (2)
This repository contains a functional exploit PoC for CVE-2024-39943, demonstrating a Remote Command Execution (RCE) vulnerability in a Node.js-based HFS server. The exploit leverages a file upload feature that executes the uploaded file's content as a system command using `child_process.execSync()`.
This repository contains a functional exploit for CVE-2024-39943, which leverages improper command execution in rejetto HFS (HTTP File Server) on Linux/UNIX/macOS. The PoC uses authenticated API calls to create a folder with a malicious name that triggers command injection via the `df` command execution mechanism.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H