Security readout for executives and security teams
Plain-English summary
This is a critical remote takeover issue in Rejetto HTTP File Server 2.3m and earlier. An attacker does not need an account or user interaction. Because CISA lists it as known exploited and the affected version is unsupported, internet-facing systems should be treated as urgent exposure.
Executive priority
Immediate action is warranted for any exposed instance. The combination of unauthenticated remote code execution, critical CVSS score, unsupported software, and CISA KEV listing makes this a high-priority remediation and incident-review item.
Technical view
CVE-2024-23692 is a CWE-1336 template injection flaw in Rejetto HFS up to 2.3m. A crafted HTTP request can lead to arbitrary command execution with no authentication. Public advisories and exploit-framework activity exist; CISA KEV supports active exploitation status.
Likely exposure
Highest risk is any internet-accessible Rejetto HFS 2.3m or earlier deployment. Internal-only instances still matter if reachable from compromised networks. The source bundle has incomplete affected-product metadata, so confirm versions directly.
Exploitation context
Active exploitation is supported by CISA KEV. Public technical writeups and a Metasploit pull request indicate attacker knowledge and tooling availability, but this assessment does not rely on or describe exploit mechanics.
Researcher notes
The core issue is template injection enabling command execution through HTTP request handling. Validate exposure without reproducing exploit behavior. Treat public module availability as a detection and prioritization signal, not proof of compromise on a specific host.
Mitigation direction
- Remove public access to Rejetto HFS 2.3m or earlier immediately.
- Migrate away from unsupported HFS 2.3m following vendor guidance.
- Restrict access with VPN, firewall allowlists, or reverse-proxy controls.
- Monitor affected hosts for signs of command execution or persistence.
- Check vendor and trusted advisory guidance for supported replacement options.
Validation and detection
- Inventory all Rejetto HFS deployments, including shadow IT file-sharing hosts.
- Confirm product version from host records, package data, or administrative evidence.
- Check whether any HFS endpoint is reachable from the internet.
- Review HTTP and endpoint logs for suspicious unauthenticated request patterns.
- Prioritize forensic review where exposure existed after public disclosure.
Public sources used
Michael Williams reviewed this cited source version on .
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1336: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-23692 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://vulncheck.com/advisories/rejetto-unauth-rceCVE reference · third-party-advisory
- https://mohemiv.com/all/rejetto-http-file-server-2-3m-unauthenticated-rce/CVE reference · third-party-advisory, technical-description
- https://github.com/rapid7/metasploit-framework/pull/19240CVE reference
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-23692CVE reference · government-resource
- https://www.vicarius.io/vsociety/posts/unauthenticated-rce-flaw-in-rejetto-http-file-server-cve-2024-23692CVE reference
- https://www.vicarius.io/vsociety/posts/cve-2024-23692-detect-rejetto-hfs-vulnerabilityCVE reference
- https://www.vicarius.io/vsociety/posts/cve-2024-23692-rejetto-hfs-mitigate-vulnerabilityCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Special Elements Used in a Template Engine
Improper Neutralization of Special Elements Used in a Template Engine represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.