What’s Vulnerable › Vulnerabilities

CVE-2014-6287: Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-03-25
• EPSS: 99.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-10-07 · updated 2026-06-17
• Weakness: CWE-94

Description

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.

Affected products

• Rejetto Http File Server: from 2.3 before 2.3c — fixed in 2.3c

How to fix

Upgrade to a fixed version: Rejetto Http File Server 2.3c. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html
• http://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execution.html
• http://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.html
• http://www.kb.cert.org/vuls/id/251276
• https://github.com/rapid7/metasploit-framework/pull/3793
• https://www.exploit-db.com/exploits/39161/
• http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html
• http://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Execution.html
• http://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execution.html
• http://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.html
• http://www.kb.cert.org/vuls/id/251276

Get alerted when CVE-2014-6287 or the next vulnerability affects your stack