CVE-2024-39943: Rejetto HTTP File Server RCE Vulnerability

CVE-2024-39943 Overview

CVE-2024-39943 is a Command Injection vulnerability affecting rejetto HFS (HTTP File Server) version 3 before 0.52.10 on Linux, UNIX, and macOS systems. The vulnerability allows authenticated remote users with Upload permissions to execute arbitrary OS commands on the underlying server. This occurs due to the unsafe use of execSync instead of spawnSync when invoking the df command through a shell in the Node.js child_process module.

Critical Impact

Authenticated attackers with upload permissions can achieve full remote code execution on affected HFS servers running on Linux, UNIX, or macOS, potentially leading to complete system compromise.

Affected Products

• rejetto HTTP File Server versions prior to 0.52.10
• HFS 3.x on Linux, UNIX, and macOS platforms
• Systems where users have been granted Upload permissions

Discovery Timeline

• 2024-07-04 - CVE-2024-39943 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-39943

Vulnerability Analysis

This vulnerability stems from improper input handling when executing system commands within the HFS application. The core issue lies in how the application invokes the df (disk free) command to retrieve filesystem information. By using Node.js's execSync function from the child_process module, the application spawns a shell to execute the command, which introduces the possibility of command injection.

When a user with Upload permissions interacts with the application in a way that triggers the df command, specially crafted input can be injected to execute arbitrary OS commands. The execSync function passes the entire command string to a system shell for interpretation, meaning shell metacharacters and command separators can be leveraged to chain additional commands.

Root Cause

The root cause is the use of execSync instead of spawnSync in the Node.js child_process module. The execSync function invokes a shell to parse and execute the command string, making it susceptible to shell injection attacks. In contrast, spawnSync directly executes the specified program without involving a shell, which prevents command injection through shell metacharacters.

The vulnerable code path executes the df command to determine disk space information. Because user-controllable input can influence the command execution context, an attacker with upload capabilities can inject malicious commands that the shell will interpret and execute.

Attack Vector

The attack requires network access and valid authentication credentials with Upload permissions on the HFS server. An authenticated attacker can craft malicious requests that inject OS commands into the vulnerable df command execution path. Since the vulnerability affects Linux, UNIX, and macOS systems, attackers can leverage platform-specific shell syntax to:

• Execute arbitrary system commands with the privileges of the HFS process
• Read, modify, or delete files on the server
• Establish reverse shells for persistent access
• Pivot to other systems on the network
• Exfiltrate sensitive data stored on the file server

The vulnerability does not require user interaction beyond the initial authentication, and the exploitation complexity is low once valid credentials with the required permissions are obtained.

Detection Methods for CVE-2024-39943

Indicators of Compromise

• Unusual shell command execution originating from the HFS Node.js process
• Unexpected child processes spawned by the HFS application
• Anomalous network connections initiated by the HFS server process
• Modified system files or unauthorized file access patterns
• Evidence of command chaining characters (;, |, &&, backticks) in application logs

Detection Strategies

• Monitor process trees for unexpected command execution originating from Node.js processes running HFS
• Implement file integrity monitoring on critical system directories and HFS installation paths
• Deploy network intrusion detection rules to identify command injection payloads in HTTP requests
• Review authentication logs for unusual upload activity patterns from specific user accounts

Monitoring Recommendations

• Enable detailed logging on the HFS application and correlate with system process logs
• Monitor for outbound connections from the HFS server to unexpected external IP addresses
• Implement alerting on new process creation events associated with the HFS process
• Audit user accounts with Upload permissions and review their activity regularly

How to Mitigate CVE-2024-39943

Immediate Actions Required

• Upgrade rejetto HFS to version 0.52.10 or later immediately
• Audit all user accounts with Upload permissions and revoke access where not strictly necessary
• Review application and system logs for evidence of exploitation
• Temporarily disable HFS or restrict network access if immediate patching is not possible
• Implement network segmentation to limit the blast radius of potential compromise

Patch Information

The vulnerability has been addressed in HFS version 0.52.10. The fix replaces the vulnerable execSync call with spawnSync, which executes the df command directly without invoking a shell, thereby eliminating the command injection vector.

Patch details are available in the GitHub commit, and the complete changes between versions can be reviewed in the version comparison on GitHub.

Workarounds

• Restrict Upload permissions to only trusted and necessary user accounts
• Place HFS behind a reverse proxy with Web Application Firewall (WAF) capabilities to filter malicious requests
• Limit network access to the HFS server using firewall rules or network ACLs
• Run HFS with minimal privileges in a containerized or sandboxed environment
• Monitor and alert on any command execution anomalies from the HFS process

# Example: Restrict HFS network access using iptables
iptables -A INPUT -p tcp --dport 80 -s 192.168.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP