CVE-2024-23692Rejetto HTTP File Server 2.3m Unauthenticated RCE
- 9.8CriticalCVSS base score
- 99.5%Exploitation in 30 daysEPSS · top 0.1% of all CVEs
- YesKnown exploitedin CISA's KEV since 9 Jul 2024
- 3Public exploitsMetasploit, Nuclei and Exploit-DB
Description
Rejetto HTTP File Server, up to and including version 2.3m, is vulnerable to a template injection vulnerability. This vulnerability allows a remote, unauthenticated attacker to execute arbitrary commands on the affected system by sending a specially crafted HTTP request. As of the CVE assignment date, Rejetto HFS 2.3m is no longer supported.
Exploited in the wild
CISA lists this vulnerability in its Known Exploited Vulnerabilities catalog as Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability.
- Added
- 9 Jul 2024
- Fix due (US federal)
- 30 Jul 2024
- Used by ransomware
- Known
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
ENISA's EU Vulnerability Database lists it as exploited, from CISA's KEV, since 9 Jul 2024.
Public exploit
An exploit or proof of concept is public: anyone can try it against an unpatched system. The public collections list a Metasploit module, a Nuclei template and an Exploit-DB entry for it. CISA's SSVC rates its exploitation: it is being exploited.
Show the exploits3
Metasploit modules1 module
- Rejetto HTTP File Server (HFS) Unauthenticated Remote Code Execution (Metasploit module) (opens in a new tab)
exploit/windows/http/rejetto_hfs_rce_cve_2024_23692Rank excellentdisclosed 25 May 2024
Nuclei templates1 template
- Rejetto HTTP File Server - Template injection (Nuclei template) (opens in a new tab)
http/cves/2024/CVE-2024-23692.yamlSeverity critical
Exploit-DB1 entry
- Rejetto HTTP File Server 2.3m - Remote Code Execution (RCE) (Exploit-DB entry) (opens in a new tab)
EDB-ID 52102webapps, typescriptpublished 28 Mar 2025Not verified
Modules, templates and exploits as listed by the Metasploit Framework (BSD-3-Clause), ProjectDiscovery's Nuclei templates (MIT) and the Exploit Database (GPLv2), read once a day. Where the data comes from
Timeline
ID reserved
By VulnCheck
- 4 months later
· 4 months later
Published
- 39 days later
· 39 days later
Added to CISA KEV
Known exploited, also by ransomware
- 2 years later
· 2 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulnCheckCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 99.5% · top 0.1% of all CVEs (15 Nov 2026)
- CISA SSVC
- Exploitation: active · Automatable: yes · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected ≤ 2.3m
What to do
Exploitation: Private exploits are known to exist
References
References7
- https://vulncheck.com/advisories/rejetto-unauth-rce (opens in a new tab)third-party-advisoryx_transferred
- https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce/ (opens in a new tab)third-party-advisorytechnical-descriptionx_transferred
- https://github.com/rapid7/metasploit-framework/pull/19240 (opens in a new tab)issue-trackingpatchx_transferred
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23692 (opens in a new tab)government-resource
- https://www.vicarius.io/vsociety/posts/unauthenticated-rce-flaw-in-rejetto-http-file-server-cve-2024-23692 (opens in a new tab)
- https://www.vicarius.io/vsociety/posts/cve-2024-23692-detect-rejetto-hfs-vulnerability (opens in a new tab)
- https://www.vicarius.io/vsociety/posts/cve-2024-23692-rejetto-hfs-mitigate-vulnerability (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- CISA KEV catalog (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2024-21153 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2024-23692)Record last updated .