Description
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).
Recommendation
Update the hfs package to the latest compatible version. Followings are version details:
- Affected version(s): < 0.52.10
- Patched version(s): 0.52.10
References
Could your website be exposed too?
SmartScanner can check your website for rejetto HFS vulnerable to OS Command Execution by remote authenticated users and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal - CVE-2024-47169
- Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin - CVE-2023-22621
- angular-base64-upload vulnerable to unauthenticated remote code execution - CVE-2024-42640
- ejs is vulnerable to remote code execution due to weak input validation - CVE-2017-1000228
You might also like:
See something that needs correcting? Let us knowUpdated November 18, 2024