{"id":"CVE-2014-6287","kind":"vulnerability","aliases":["CVE-2014-6287"],"related":[],"title":"Rejetto HTTP File Server (HFS): Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability","description":"The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Rejetto HFS 2.3, 2.3a and 2.3b fail to handle a null byte (%00) in the search action. The parserLib.pas macro parser then runs the commands that follow it. An unauthenticated remote attacker gets command execution on the Windows host. It is exploited in the wild, is on CISA KEV, and has a public Metasploit module and PoC.","severity":"critical","cvss":10.0,"epss":0.99323,"exploited":true,"exploited_at":"2022-03-25T00:00:00+00:00","products":[{"name":"Rejetto HTTP File Server (HFS)","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Rejetto HTTP File Server (HFS)","fixed":["2.3c"],"affected":">= 2.3, < 2.3c","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","package","rce","rejetto-hfs","self-hosted","unauthenticated","windows"],"not_affected_if":["not-running-hfs"],"how_to_check":"Open HFS (hfs.exe) and read the version in the window title or the About box. Any 2.3, 2.3a or 2.3b is vulnerable. Check for exposed instances: a request to http://HOST:PORT/?search==%00{.exec|calc.} launches calc on a vulnerable server, so only test hosts you own. Also look for hfs.exe running and listening on a port, and check web logs for requests with %00 or {.exec in the search parameter.","fix":"Upgrade to HFS 2.3c or later (CERT/CC VU#251276). Because 2.3c is itself affected by CVE-2014-7226 (file comment macro injection), use 2.3d or later (rejetto lists 2.3d as security fixes). 2.3m and earlier are affected by CVE-2024-23692, so the 2.x line is unsupported and best replaced with HFS 3. If you cannot upgrade, stop HFS and do not expose it to the internet. If it was exposed while on 2.3 to 2.3b, treat the host as compromised.","status":"open","published_at":"2014-10-07T10:55:04+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:22:00+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"package","confidence":0.9,"triage":{"at":"2026-10-23T21:22:00Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update per CISA's known-exploited-vulnerabilities guidance; the specific fixed version is unknown from the sources.\nRemove or stop HFS if no update is available.","reach":"internet","impact":"high","summary":"Rejetto HTTP File Server (HFS) has a flaw in its parserLib.pas template parsing where the findMacroMarker function lets remote attackers run arbitrary programs on the server. Attackers can take over the host without credentials, and CISA lists it as actively exploited.","category":"package","who_cares":["windows","self-hosted","rejetto-hfs"],"confidence":0.7,"needs_auth":"no","worst_case":"Remote attacker runs arbitrary programs on the server host","analyst_note":"Find the fixed HFS version and a how-to-check method (process name, version banner, or file path) from the CISA KEV entry or the vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-running-hfs"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000481,"input_tokens":2865,"output_tokens":388,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed HFS version and a how-to-check method (process name, version banner, or file path) from the CISA KEV entry or the vendor advisory.","search":"'-2014':16A,19A '-6287':17A,20A '00':56B '2.3':44B,45B,48B 'action':60B,123C 'allow':114C 'appli':124C 'arbitrari':119C 'attack':75B,116C 'b':49B 'byte':55B 'cisa':91B,121C 'code':12A 'command':68B,77B 'cve':15A,18A 'execut':13A,78B,118C 'exploit':31B,85B 'fail':50B 'file':3A,8A,23A,28A,109C 'findmacromark':102C 'follow':70B 'function':103C 'get':76B 'handl':52B 'hfs':5A,10A,25A,30A,36B,43B,111C 'host':39B,82B 'http':2A,7A,22A,27A,108C 'httpfileserv':113C 'instruct':128C 'kev':92B 'macro':63B 'metasploit':97B 'modul':98B 'null':54B 'packag':32B 'parser':64B 'parserlib.pas':62B,105C 'per':126C 'poc':100B 'program':120C 'public':96B 'rce':33B 'rejetto':1A,6A,21A,26A,35B,42B,107C 'rejetto-hf':34B 'remot':11A,74B,115C 'requir':122C 'run':66B 'search':59B 'self':38B 'self-host':37B 'server':4A,9A,24A,29A,110C 'unauthent':40B,73B 'updat':125C 'vendor':127C 'vulner':14A 'wild':88B 'window':41B,81B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2014-10-07T10:55:04+00:00","kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":1,"sources":[{"source":"kev","external_id":"CVE-2014-6287","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-6287","severity":null,"published_at":"2022-03-25T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T10:39:07+00:00","note":null},{"source":"epss","external_id":"CVE-2014-6287","url":"https://api.first.org/data/v1/epss?cve=CVE-2014-6287","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2014-6287:67","url":null,"severity":null,"published_at":"2026-10-23T21:23:41+00:00","modified_at":"2026-10-23T21:23:41+00:00","first_seen_at":"2026-10-23T21:23:41+00:00","fetched_at":"2026-10-23T21:23:41+00:00","note":"Read CERT/CC VU#251276, rejetto 2.3c release post, NVD. Affected 2.3 to 2.3b, fixed in 2.3c (Sept 2014). Exploited, Metasploit module and Exploit-DB PoC public. Note the follow-on CVE-2014-7226 affects 2.3c, so move to 2.3d or later. I did not read the 2.3d details page."},{"source":"nvd","external_id":"CVE-2014-6287","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6287","severity":null,"published_at":"2014-10-07T10:55:04+00:00","modified_at":"2026-06-17T00:12:50+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":969,"url":"https://www.kb.cert.org/vuls/id/251276","title":"VU#251276 Rejetto HFS null byte RCE","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":977,"url":"https://rejetto.com/forum/index.php?topic=11461.0","title":"rejetto: New version 2.3c","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":970,"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6287","title":"NVD CVE-2014-6287","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":971,"url":"https://www.exploit-db.com/exploits/39161/","title":"Exploit-DB 39161 HFS 2.3.x RCE","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}