CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-39943

Critical Severity
Rejetto
SVRS
85/100
CVSSv3
8.8/10
EPSS
0.72267/1

CVE-2024-39943 is a critical vulnerability in rejetto HFS (HTTP File Server) that allows remote attackers to execute arbitrary OS commands. Specifically, versions before 0.52.10 on Linux, UNIX, and macOS are affected if the attacker has upload permissions. The HFS vulnerability stems from using a shell to execute the df command unsafely.

Given its SOCRadar Vulnerability Risk Score (SVRS) of 85, CVE-2024-39943 is classified as a critical vulnerability requiring immediate attention. This score reflects the increased risk due to publicly available exploits and its active exploitation "In The Wild". Successful exploitation could lead to complete system compromise, data breaches, and significant operational disruption. Organizations using affected versions of rejetto HFS should upgrade to version 0.52.10 or later immediately to mitigate this severe threat.

TAGS
In The Wild
Exploit Avaliable
VECTOR STRING
CVSS:3.1
AV:N
AC:L
PR:L
UI:N
S:U
C:H
I:H
A:H
PUBLICATION DATE2024-07-04
LAST MODIFIED2024-07-08

Indicators of Compromise

No IOCs found for this CVE

Exploits

TitleSoftware LinkDate
A-little-dragon/CVE-2024-39943-Exploithttps://github.com/A-little-dragon/CVE-2024-39943-Exploit2024-07-06
truonghuuphuc/CVE-2024-39943-Pochttps://github.com/truonghuuphuc/CVE-2024-39943-Poc2024-07-05
Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

Cyber Security News Weekly Round-Up (Vulnerabilities, Cyber Attacks, Threats & New Stories)
Guru Baran2024-07-07
Cyber Security News Weekly Round-Up (Vulnerabilities, Cyber Attacks, Threats & New Stories) | The weekly cyber security newsletter is a brief summary of what the most recent threats, vulnerabilities, and innovations in the digital security space are all about. This weekly drill encourages a deeper comprehension of the quick-changing malicious tactics, and threat environment by facilitating timely adjustments to security protocols. Eventually, this helps organizations and individuals to […] The post Cyber Security News Weekly Round-Up (Vulnerabilities, Cyber Attacks, Threats & New
cybersecuritynews.com
rss
forum
news
PoC Exploit Released for HTTP File Server Remote Code Execution Vulnerability
Guru Baran2024-07-06
PoC Exploit Released for HTTP File Server Remote Code Execution Vulnerability | A proof-of-concept (PoC) exploit has been released for a critical remote code execution vulnerability in the HTTP File Server (HFS) software, identified as CVE-2024-39943. This vulnerability affects HFS version 3 before 0.52.10 on Linux, UNIX, and macOS systems, allowing remote authenticated users with upload permissions to execute OS commands due to the use of execSync […] The post PoC Exploit Released for HTTP File Server Remote Code
cybersecuritynews.com
rss
forum
news
CVE-2024-39943 | Rejetto HTTP File Server up to 0.52.9 on Linux/Unix/macOS Upload Node.js child_process Privilege Escalation
vuldb.com2024-07-05
CVE-2024-39943 | Rejetto HTTP File Server up to 0.52.9 on Linux/Unix/macOS Upload Node.js child_process Privilege Escalation | A vulnerability has been found in Rejetto HTTP File Server up to 0.52.9 on Linux/Unix/macOS and classified as critical. This vulnerability affects the function child_process of the file Node.js of the component Upload Handler. The manipulation leads to Privilege Escalation. This vulnerability was
cve-2024-39943
domains
urls
cves

Social Media

Critical vulnerability identified as CVE-2024-39943 with a CVSS score of 9.9 pertains to a significant flaw in the HTTP File Server, potentially leading to Remote Code Execution (RCE) and exposing systems to severe risks. Details: https://t.co/XRIm2DiXJH #cybersecurity #infosec
0
0
0
A proof-of-concept (PoC) exploit has been released for a critical remote code execution vulnerability in the HTTP File Server (HFS) software, identified as CVE-2024-39943. This vulnerability affects HFS version 3 before 0.52.10 on… https://t.co/3kJPlJQKWK #CyberSecurity #InfoSec
0
0
0
CVE-2024-39943 rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell... https://t.co/YJMqe8fSGV
0
0
0
CVE-2024-39943 rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissio… https://t.co/9TtFukEsJX
0
0
2
[CVE-2024-39943: CRITICAL] Cyber security alert: Vulnerability in rejetto HFS allows remote authenticated users to execute OS commands. Update to version 0.52.10 to stay protected.#cybersecurity,#vulnerability https://t.co/2XrK0mRCvl https://t.co/2zWVbs7css
0
0
0

Affected Software

Configuration 1
TypeVendorProduct
AppRejettohttp_file_server

References

ReferenceLink
[email protected]https://github.com/rejetto/hfs/commit/305381bd36eee074fb238b64302a252668daad1d
[email protected]https://github.com/rejetto/hfs/compare/v0.52.9...v0.52.10
[email protected]https://www.rejetto.com/wiki/index.php/HFS:_Working_with_uploads

CWE Details

CWE IDCWE NameDescription
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-284Improper Access ControlThe software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence