Critical Remote Code Execution in Rejetto HTTP File Server (CVE‑2024‑23692) Enables Unauthenticated Command Execution
What It Is — Rejetto HTTP File Server (HFS) contains an improper neutralization of special elements in its template engine. A crafted HTTP request can trigger command execution on the host without authentication.
Exploitability — The vulnerability is publicly disclosed (CVE‑2024‑23692) and rated high‑severity; proof‑of‑concept code is available, making remote exploitation feasible.
Affected Products — Rejetto HTTP File Server (all supported versions prior to the vendor’s forthcoming patch).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls that capture, assess, and remediate flaws before they are weaponised.
- Provides audit‑ready evidence that an organization is actively monitoring third‑party software for known weaknesses.
- Aligns with a single control objective—maintain a robust patch‑and‑update process—which satisfies multiple frameworks (e.g., NIST CSF, ISO 27001, PCI DSS).
Recommended Actions
- Identify all instances of Rejetto HTTP File Server in your environment.
- Apply the vendor‑released patch or upgrade to a non‑vulnerable version immediately.
- Record remediation steps in your vulnerability‑management system to create defensible audit evidence.
- Review and tighten your third‑party software inventory and patch‑testing procedures.
Source: CISA KEV – CVE‑2024‑23692