Rejetto HTTP File Server Template Injection RCE (CVE-2024-50623)

CVE-2024-50623 is a critical template injection in Rejetto HTTP File Server (HFS) 2.3m and related builds. Remote attackers send a single crafted HTTP request to achieve unauthenticated RCE on Windows and Linux hosts running HFS for quick file sharing.

Affected software

• Rejetto HFS 2.3m (and repackaged forks without patch)
• Lab machines, dev shares, and legacy file-drop servers

Find instances on network

nmap -p 80,8080 --script http-title 10.0.0.0/24
curl -s http://target:8080/ | grep -i hfs

Remediation

• Upgrade to HFS 2.4 or later from official Rejetto builds
• Remove HFS from production networks — use SFTP, S3, or managed file shares
• Block inbound access to HFS ports at perimeter firewall
• Hunt for new admin users and reverse shells on affected hosts

Public PoC dropped quickly; treat any HFS 2.3m on the internet as compromised.