CVE-2014-6287: Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability

CVE-2014-6287 is a remote code execution vulnerability in Rejetto HTTP File Server (HFS, also known as HttpFileServer). The flaw sits in the findMacroMarker function within parserLib.pas and lets remote attackers execute arbitrary programs on the host. For IT and security teams, this matters because HFS is often exposed to share files over HTTP; successful abuse can give an attacker full control of the server process and a foothold into the surrounding network.

Public detail is limited to the CISA description and the CWE-94 classification. Confirm exact affected builds, fixed releases, and any configuration prerequisites directly against the vendor advisory before acting.

How it works

The weakness is CWE-94 (Improper Control of Generation of Code), commonly called code injection. In this case the server’s macro-parsing logic fails to adequately constrain input that reaches findMacroMarker. An unauthenticated remote attacker can supply crafted request data that the parser treats as executable content, causing the HFS process to launch arbitrary programs under its own privileges.

No exploit mechanics beyond that summary are provided here. Treat any publicly circulating proof-of-concept as untrusted until you have verified it against the vendor’s own technical notes. The practical outcome is straightforward: the attacker gains the ability to run commands on the system hosting HFS, which can lead to persistence, lateral movement, or data theft depending on the account under which the service runs.

Am I affected? How to find it in your systems

Rejetto HFS is a lightweight Windows-oriented HTTP file server typically deployed for ad-hoc file sharing, internal drop boxes, or small workgroup use. It may appear on developer workstations, file-share VMs, or legacy appliances that were never intended for long-term internet exposure.

• Inventory: Search software inventories, SCCM/Intune/endpoint-management consoles, and process lists for “HFS”, “HttpFileServer”, or the rejetto executable name. Check listening ports commonly used by simple HTTP file servers (often 80, 8080, or a custom high port).
• Version and configuration check: Compare the installed build against the fixed versions listed in the vendor advisory. Note whether the service is bound to all interfaces or only localhost, and whether authentication or access-control lists are enabled.
• Network discovery: Use internal vulnerability scanners or banner-grabbing against HTTP services; HFS often returns a distinctive server header or default page. Confirm any positive hit with a manual version query rather than relying solely on CVE signatures.
• Telemetry signs: Look for unexpected child processes spawned by the HFS executable, outbound connections initiated by that process, or HTTP requests containing unusual macro-like strings in URI or body fields. Centralized Windows event logs and EDR process-creation events are the most reliable sources.

If you cannot determine the exact build, assume the instance is vulnerable until the vendor advisory proves otherwise.

How to remediate

Patch first. Apply the updates supplied by the vendor exactly as described in their advisory—the CISA-required action is simply “Apply updates per vendor instructions.” After patching, restart the service and verify the new version string.

• Remove or disable any HFS instances that are no longer required.
• If the service must remain, run it under a least-privilege account, bind it only to necessary interfaces, and place it behind authentication and network access controls.
• Harden the host: keep the underlying OS patched, enable application whitelisting where feasible, and restrict outbound traffic from the HFS process.
• Re-scan after remediation to confirm the vulnerability signature is cleared and that no residual test files or backdoors remain.

If you can't patch immediately

Implement compensating controls while you schedule the update:

• Network segmentation: Move the host into a restricted VLAN or security group; allow inbound HTTP only from known management or user subnets and block all unnecessary outbound traffic.
• Virtual patching / WAF: If a web application firewall or reverse proxy sits in front of HFS, add rules that drop requests containing suspicious macro or command-injection patterns. Tune carefully to avoid breaking legitimate file-transfer use.
• Feature reduction: Disable any macro or scripting features the product exposes if the vendor documentation permits it; otherwise shut the service down until a patch can be applied.
• Heightened monitoring: Alert on process-creation events where the parent is the HFS binary, on unusual file writes in the HFS directory tree, and on authentication failures or anomalous request volumes. Retain packet captures of traffic to the service for later forensic review.

These measures reduce but do not eliminate risk; treat them as temporary.

If your data may have been exposed

Actively exploited remote-code-execution vulnerabilities frequently precede broader compromise. If logs or EDR data indicate successful exploitation, isolate the host, preserve volatile evidence, and begin incident-response procedures. Review what files were shared through HFS and whether credentials or sensitive data resided on the same system. You can run a free exposure scan of your email addresses against known breach data sets to determine whether associated accounts have appeared in prior incidents, then force password resets and enable multi-factor authentication where applicable.