CVE-2014-6287 : The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c a

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.

Published 2014-10-07 10:55:04

Updated 2021-02-26 21:56:10

Source MITRE

View at NVD, CVE.org

CVE-2014-6287 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.

Added on 2022-03-25 Action due date 2022-04-15

Exploit prediction scoring system (EPSS) score for CVE-2014-6287

Probability of exploitation activity in the next 30 days: 97.28%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2014-6287

Rejetto HttpFileServer Remote Command Execution

Disclosure Date: 2014-09-11

First seen: 2020-04-26

exploit/windows/http/rejetto_hfs_exec

Rejetto HttpFileServer (HFS) is vulnerable to remote command execution attack due to a poor regex in the file ParserLib.pas. This module exploits the HFS scripting commands by using '%00' to bypass the filtering. This module has been tested successfully on HFS 2.3b o

More information

CVSS scores for CVE-2014-6287

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2014-6287

CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-6287

http://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Execution.html

Rejetto HTTP File Server 2.3.x Remote Code Execution ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html

HttpFileServer 2.3.x Remote Command Execution ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
https://github.com/rapid7/metasploit-framework/pull/3793

Http File Server Remote Command Exec by mfadzilr · Pull Request #3793 · rapid7/metasploit-framework · GitHub
Exploit
https://www.exploit-db.com/exploits/39161/

Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (2) - Windows remote Exploit
Exploit;Third Party Advisory;VDB Entry
http://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.html

HFS (HTTP File Server) 2.3.x Remote Code Execution ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execution.html

Rejetto HttpFileServer 2.3.x Remote Command Execution ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://www.kb.cert.org/vuls/id/251276

VU#251276 - Rejetto HTTP File Server (HFS) search feature fails to handle null bytes
Third Party Advisory;US Government Resource

Products affected by CVE-2014-6287

Rejetto » Http File Server
Versions from including (>=) 2.3 and before (<) 2.3c
cpe:2.3:a:rejetto:http_file_server:*:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2014-6287