CVE-2024-23692: Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability

CVE-2024-23692 is an improper neutralization of special elements used in a template engine vulnerability in Rejetto HTTP File Server. A remote, unauthenticated attacker can send a specially crafted HTTP request that causes the product to execute commands on the affected system. This matters because the attack requires no credentials and can give an outsider full control of the host running the file server, which often holds shared files and may sit on internal networks.

Defenders should treat any internet-reachable or poorly segmented instance as high priority until the vendor-recommended mitigations are confirmed in place or the product is removed.

How it works

The underlying weakness is CWE-1336: improper neutralization of special elements used in a template engine. Template engines evaluate or render content that can include user-supplied data. When that data is not correctly sanitized, an attacker can inject template directives or expressions that the engine then executes with the privileges of the server process.

In this case the CISA summary states that a specially crafted HTTP request is sufficient. The request reaches a code path that feeds attacker-controlled input into the template engine without adequate neutralization, resulting in command execution. Exact request format, payload construction, and any required parameters are not provided here; teams must obtain those details only from the vendor advisory or trusted analysis that cites it. No authentication is required, so the attack surface is any network-accessible instance of the product.

Am I affected? How to find it in your systems

Rejetto HTTP File Server is typically deployed as a lightweight file-sharing service on Windows or other hosts, often by small teams or for temporary sharing. It may appear as a standalone executable or service listening on HTTP/HTTPS ports.

• Inventory: search asset-management databases, software inventories, and process lists for “Rejetto,” “HFS,” or the product’s executable name. Check listening ports and web banners that identify the server.
• Version and configuration: compare installed builds against the versions listed as vulnerable in the vendor advisory. Confirm whether the template-engine features that process HTTP input are enabled.
• Network exposure: identify any instances reachable from untrusted networks; these are the most urgent.
• Telemetry: review web-access logs for anomalous or highly unusual HTTP requests that contain template-like syntax or unexpected characters. Correlate with process-creation events that spawn shells or unexpected child processes shortly after such requests. Absence of known indicators does not prove safety; confirm patch status directly.

Specifics of affected versions and exact log signatures must be verified against the vendor advisory.

How to remediate

The primary action is to apply the mitigations or updates published by the vendor, exactly as instructed. CISA’s required action is to apply those mitigations or to discontinue use of the product if mitigations are unavailable.

• Obtain the official advisory, identify the fixed build or configuration change, and deploy it through your normal change process.
• After patching, restart the service if required and re-verify the version and listening configuration.
• If the product is no longer needed, remove it entirely rather than leaving an unpatched instance running.
• For the broader class of template-injection flaws, ensure that any remaining user-controlled input is strictly sanitized or that the template engine is configured to disable dangerous evaluation features.

Do not rely on unofficial patches or third-party “fixes” that have not been validated against the vendor guidance.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls:

• Network segmentation: place the host behind a firewall or ACL that permits access only from trusted management networks; block all unsolicited inbound traffic from the internet.
• Virtual patching / WAF: if a web application firewall is available, deploy rules that block requests containing template-engine metacharacters or other patterns associated with this class of attack (confirm signatures against current threat intelligence).
• Feature disablement: if the product allows disabling the template-processing path or related HTTP handlers, turn those features off.
• Monitoring: enable detailed HTTP and process-creation logging; alert on anomalous requests or unexpected command execution. Retain logs for later forensic review.
• Discontinue use: if mitigations cannot be applied and the service is non-critical, shut it down until a patched version is available.

These steps lower risk but do not eliminate it; schedule the permanent fix as soon as possible.

If your data may have been exposed

Vulnerabilities that allow unauthenticated remote command execution are frequently used to establish persistence, steal files, or move laterally. Although ransomware use of this specific CVE is not documented, any successful exploitation can lead to data theft or further compromise. Review access logs and host forensics for signs of intrusion. As a quick additional check, you can run a free exposure scan of your email addresses against known breach data to see whether credentials or personal information have already appeared in public dumps.