---
id: "CVE-2014-6287"
kind: "vulnerability"
aliases: ["CVE-2014-6287"]
title: "Rejetto HTTP File Server (HFS): Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.99323
exploited: true
status: "open"
category: "package"
products: [{"name": "Rejetto HTTP File Server (HFS)", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Rejetto HTTP File Server (HFS)", "fixed": ["2.3c"], "affected": ">= 2.3, < 2.3c", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "package", "rce", "rejetto-hfs", "self-hosted", "unauthenticated", "windows"]
not_affected_if: ["not-running-hfs"]
published_at: "2014-10-07T10:55:04+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-6287", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2014-6287", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:23:41+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-6287", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Rejetto HTTP File Server (HFS): Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability

Rejetto HFS 2.3, 2.3a and 2.3b fail to handle a null byte (%00) in the search action. The parserLib.pas macro parser then runs the commands that follow it. An unauthenticated remote attacker gets command execution on the Windows host. It is exploited in the wild, is on CISA KEV, and has a public Metasploit module and PoC.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Rejetto HTTP File Server (HFS) affected ? fixed ?
- vendor:Rejetto HTTP File Server (HFS) affected >= 2.3, < 2.3c fixed 2.3c

## How to check

Open HFS (hfs.exe) and read the version in the window title or the About box. Any 2.3, 2.3a or 2.3b is vulnerable. Check for exposed instances: a request to http://HOST:PORT/?search==%00{.exec|calc.} launches calc on a vulnerable server, so only test hosts you own. Also look for hfs.exe running and listening on a port, and check web logs for requests with %00 or {.exec in the search parameter.

## Fix

Upgrade to HFS 2.3c or later (CERT/CC VU#251276). Because 2.3c is itself affected by CVE-2014-7226 (file comment macro injection), use 2.3d or later (rejetto lists 2.3d as security fixes). 2.3m and earlier are affected by CVE-2024-23692, so the 2.x line is unsupported and best replaced with HFS 3. If you cannot upgrade, stop HFS and do not expose it to the internet. If it was exposed while on 2.3 to 2.3b, treat the host as compromised.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2014-6287
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2014-6287
- 2026-10-23T21:23:41+00:00 analyst — Read CERT/CC VU#251276, rejetto 2.3c release post, NVD. Affected 2.3 to 2.3b, fixed in 2.3c (Sept 2014). Exploited, Metasploit module and Exploit-DB PoC public. Note the follow-on CVE-2014-7226 affects 2.3c, so move to 2.3d or later. I did not read the 2.3d details page.
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2014-6287

## Documents

- [advisory] VU#251276 Rejetto HFS null byte RCE https://www.kb.cert.org/vuls/id/251276
- [describes] NVD CVE-2014-6287 https://nvd.nist.gov/vuln/detail/CVE-2014-6287
- [fix] rejetto: New version 2.3c https://rejetto.com/forum/index.php?topic=11461.0
- [poc] Exploit-DB 39161 HFS 2.3.x RCE https://www.exploit-db.com/exploits/39161/

## From the sources

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_