CVE-2024-23692: Rejetto HTTP File Server unauthenticated RCE, actively exploited
The short version: Rejetto HTTP File Server (HFS), up to and including version 2.3m, has a template-injection flaw (CVE-2024-23692) that lets a remote, unauthenticated attacker execute arbitrary commands by sending a single crafted HTTP request. It's exploited in the wild, it's in CISA's KEV catalog, and HFS 2.3m is no longer supported — so there's no patch for that line, only migration. Steady hands — but move: get off 2.3m.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 99.49% · 99.9th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation due 2024-07-30 (added 2024-07-09) |
| Known exploited? | Yes — actively exploited in the wild |
| Vulnerability type | CWE-94 / CWE-1336 template injection → unauthenticated remote command execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Rejetto HFS up to and including 2.3m (this line is end-of-life) |
| Fixed in | Migrate to the rebuilt HFS 2.4+ line (2.3m receives no fix) |
What you need to know
HFS is a small, popular tool for standing up a quick file server over HTTP. Older versions render templates in a way that doesn't safely separate user-controlled input from template directives, so a crafted request smuggles in an expression that the server evaluates — turning a file-serving web request into command execution on the host.
- It's pre-authentication and trivially automatable. One crafted HTTP request; no credentials, no user interaction. Public exploit code exists.
- It's end-of-life. HFS 2.3m is unsupported. The developer's answer is the rewritten HFS (2.4 and later), which is a migration, not a drop-in patch — so vulnerable instances tend to linger.
- It's the kind of thing people forget. HFS often appears as a temporary share that quietly stays online.
How serious we see it
High — the 9.8 is earned.
Unauthenticated remote code execution, reachable over the network, with public exploits and confirmed in-the-wild use, is top-of-queue. The wrinkle that makes it worse than a normal patch job is the end-of-life status: there's no update for 2.3m, so remediation means moving to the new HFS or retiring the service. The reassuring, bounded part is that the fix is decisive once you commit — the vulnerable code simply shouldn't be exposed anymore.
Recommendations
Straight from the advisory and CISA:
- Get off 2.3m now. Migrate to the rebuilt HFS 2.4+, or retire the service if it's no longer needed. There is no patch for the 2.3m line.
- If you can't migrate immediately, pull it off the internet. Restrict access to trusted networks or a VPN as a stopgap — do not leave 2.3m publicly reachable.
- Hunt for compromise. Given active exploitation, review the host for unexpected processes, new files/accounts, and web shells around the exposure window.
- If you find indicators, respond. Rebuild the host, rotate credentials, and investigate for lateral movement.
- Confirm your exposure first. Verify whether any HFS instance is internet-facing and which version it reports.
How BreachRisk sees it
BreachRisk discovers internet-facing HFS instances from little more than your domain, fingerprints the Rejetto version, and flags exposure tied to this KEV-listed, actively exploited flaw — raised to the top of your results because it's in KEV. We detect and flag the exposed, affected server; it's exactly the kind of forgotten, end-of-life service that our outside-in view is built to surface.
When a quick file share becomes an unauthenticated RCE that attackers are already spraying, having it already mapped means you can go straight to migrate-or-retire.