CVERadar
CRITICAL · CVSS 3.1 9.8CISA KEV · added 2024-07-09Metasploit moduleExploit-DBPublic PoCKnown ransomware useEPSS 99.48% (p100)Threat level 99

CVE-2024-23692: Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

Rejetto · HTTP File Server · NVD published 2024-05-31 · posted 2024-07-09 · last modified 2026-08-11

What it is

Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.

WeaknessCWE-1336CWE-94
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (source: [email protected])
CISA due date2024-07-30 (for US federal agencies under BOD; a good deadline for everyone)
ATT&CK tacticsStealth → Discovery → Collection → Command and Control → Impact

Exploitation evidence

First exploit evidence seen: 2024-05-25 (earliest date across the sources below).

Exploited in the wild

  • CISA KEV: listed since 2024-07-09. Source

Public exploit code

Metasploit

Exploit-DB

  • EDB-52102: Rejetto HTTP File Server 2.3m - Remote Code Execution (RCE) (2025-03-28)

GitHub proof-of-concept repositories

14 public repositories from 14 accounts, first seen 2024-06-11. Most starred: verylazytech/CVE-2024-23692 (51 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: CISA KEV · Rapid7 Metasploit Framework module metadata · Exploit-DB (OffSec) · nomi-sec/PoC-in-GitHub.

Defend the Chain

The attack chain for CVE-2024-23692 laid across the MITRE ATT&CK Enterprise tactics. Solid cards come from the MITRE CTID KEV mappings; dashed cards are inferred by CVERadar from the CWE or description. Correct defences are real ATT&CK mitigations for that technique.

Threat level 99/100
Defender level 1 · 0 XP
Chain links broken: 0/5

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Stealth

Defense Impairment

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Pick a red technique card on the board, then choose the defence that stops it.

Defend against T1221 Template Injection CTID: exploitation technique

CVE-2024-23692 is a OS command injection vulnerability within the HTTP File Server (HFS) process for Rejetto. It has been reported to be exploited by threat actors to deploy cryptomining malware, install backdoors, Remote Access Trojans (RATs), and other malware like “GoThief” to exfiltrate sensitive data.

How to fix it

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)

Fixed versions

  • rejetto http file server: versions up to and including 2.4 are affected; check the vendor advisory for the fixed release.

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

MITRE ATT&CK mitigations for this chain

  • M1049 Antivirus/Antimalware (for T1221) : Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.
  • M1031 Network Intrusion Prevention (for T1221, T1105) : Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.
  • M1017 User Training (for T1221) : Train users to identify social engineering techniques and spearphishing emails that could be used to deliver malicious documents.
  • M1042 Disable or Remove Feature or Program (for T1221) : Consider disabling Microsoft Office macros/active content to prevent the execution of malicious payloads in documents , though this setting may not mitigate the [Forced Authentication](https://attack.mitre.org/techniques/T1187) use for this technique.
  • M1057 Data Loss Prevention (for T1005) : Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.
  • M1037 Filter Network Traffic (for T1105) : Use network filtering to block outbound traffic from compromised systems to unapproved external destinations. Restricting access to known, trusted IP addresses and protocols can prevent attackers from downloading malicious tools or payloads onto compromised servers after gaining initial access.

Detection Generic guidance

  • Discovery: Look for directory listing, file enumeration and reconnaissance commands from service accounts.
  • Collection: Watch for bulk reads of databases, file shares or mailboxes by the affected service.
  • Command and Control: Alert on outbound connections from the server to new or rare destinations.
  • Impact: Monitor service availability, unexpected encryption activity and mass file changes.

Response checklist Generic guidance

  1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
  2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
  3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
  4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.

Sources