rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
References
Configurations
History
08 Jul 2024, 16:42
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
| CPE | cpe:2.3:a:rejetto:http_file_server:*:*:*:*:*:*:*:* | |
| First Time |
Rejetto http File Server
Rejetto |
|
| CWE | CWE-78 | |
| References | () https://github.com/rejetto/hfs/compare/v0.52.9...v0.52.10 - Patch | |
| References | () https://github.com/rejetto/hfs/commit/305381bd36eee074fb238b64302a252668daad1d - Patch | |
| References | () https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads - Product |
04 Jul 2024, 23:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-07-04 23:15
Updated : 2024-07-08 16:42
NVD link : CVE-2024-39943
Mitre link : CVE-2024-39943
JSON object : View
Products Affected
rejetto
- http_file_server
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')