Threat Intelligence Database

Rejetto HFS 3.0.0 through 3.2.0 allows path traversal through the lang query parameter, permitting a remote unauthenticated attacker to read certain JSON files outside the shared folders. Exploitation is constrained to files matching a narrow naming and format pattern, limiting practical impact.

Rejetto HFS 3.0.0 through 3.2.0 does not escape file names in its fallback "basic" web listing, and this listing can be forced by any browser via the ?get=basic parameter. A user with upload permission - or an anonymous user on servers with an open upload folder - can store a file whose name contains script that executes in the browser of anyone viewing the listing.

Rejetto HFS versions 3.0.0 through 3.2.0 have a vulnerability where the login endpoint returns different responses depending on whether a submitted username exists. This allows a remote unauthenticated attacker to confirm valid account names, including the default admin account, which can facilitate further attacks such as password guessing and session forgery. The vulnerability has a medium severity with a CVSS score of 6.9. No official patch or remediation guidance is currently provided by the vendor.

Rejetto HFS versions 3.0.0 through 3.2.0 are vulnerable to a Cross-Site Request Forgery (CSRF) attack due to accepting state-changing API requests via the GET method without enforcing anti-CSRF header checks on these requests. This allows a remote attacker to perform administrative actions, including account creation and configuration changes, potentially leading to code execution. The attack can be executed by tricking a logged-in administrator into visiting a crafted URL or, in default installations, without credentials if the attack originates from the server's own machine.

Rejetto HFS versions 3.0.0 through 3.2.0 have a cross-site scripting (XSS) vulnerability in the administration panel. The software renders log entries as HTML without sanitization, allowing a remote unauthenticated attacker to inject malicious JavaScript via a crafted username in failed login attempts. When an administrator views the logs, the injected script executes, potentially enabling account creation or code execution with administrator privileges. The vulnerability has a medium severity rating and a CVSS score of 5.3.

Rejetto HFS versions 3.0.0 through 3.2.0 use a cryptographically weak pseudo-random number generator (Math.random()) to derive session-cookie signing keys and disclose outputs of this generator to unauthenticated clients during login. This weakness allows a remote attacker to reconstruct the generator's state, recover the signing key, and forge valid administrator session cookies. Successful exploitation leads to full administrative access and remote code execution via the server_code configuration feature.