CVE-2026-61502: Rejetto HFS CSRF Vulnerability

CVE-2026-61502 Overview

CVE-2026-61502 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] affecting Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0. The application accepts state-changing API requests via HTTP GET and exempts GET requests from its anti-CSRF header check. An attacker can trigger administrative actions, including account creation and configuration changes that lead to code execution, by luring a logged-in administrator to a crafted URL. Against default installations, the same attack succeeds without credentials when the request originates from the server's own machine (loopback).

Critical Impact
Successful exploitation enables unauthenticated or authenticated administrative actions on the HFS server, chaining to remote code execution through configuration abuse.

Affected Products

Rejetto HFS 3.0.0
Rejetto HFS versions 3.0.0 through 3.2.0
Fixed in Rejetto HFS 3.2.1

Discovery Timeline

2026-07-13 - CVE-2026-61502 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-61502

Vulnerability Analysis

Rejetto HFS 3 exposes an administrative HTTP API that normally enforces an anti-CSRF header on state-changing operations. The check is applied only to non-GET requests. Because the server also honors GET for state-changing endpoints, an attacker can bypass the protection entirely by issuing the sensitive operation as a simple GET request. A browser fetching an attacker-controlled page will attach the administrator's session cookie automatically, and the request will succeed with full administrative privileges.

The attack path extends beyond account manipulation. HFS administrative endpoints allow configuration changes that can be leveraged to reach code execution, so CSRF-induced settings mutations translate into a full server compromise rather than a UI-level annoyance.

Root Cause

The root cause is an incomplete CSRF defense that treats HTTP method as a proxy for request safety. RFC 7231 defines GET as a safe method, but HFS 3 routes state-changing operations through GET while simultaneously excluding those requests from its custom anti-CSRF header validation. The combination of method overloading and header-based defense scoping produces a bypass by design.

Attack Vector

Exploitation is network-based and requires user interaction from a logged-in administrator, such as visiting a malicious page or clicking a crafted link. The attacker embeds resources like <img> or <script> tags, or a redirect to an HFS admin URL, and the victim's browser silently issues the authenticated request. In default installations, requests originating from the server's own machine bypass authentication, so the same CSRF technique executed against 127.0.0.1 requires no credentials. The vulnerability manifests in the request-routing and CSRF-verification logic; refer to the VulnCheck Advisory: Rejetto HFS CSRF for endpoint-level details.

Detection Methods for CVE-2026-61502

Indicators of Compromise

Unexpected administrator accounts appearing in the HFS user database or configuration file.
HFS access logs showing GET requests to administrative API endpoints with query-string parameters that modify server state.
Configuration file (hfs.config or equivalent) modifications with timestamps that do not correlate with legitimate administrator sessions.
HTTP Referer headers on admin API calls pointing to external domains.

Detection Strategies

Alert on HFS admin API endpoints invoked with the GET method carrying state-changing parameters such as account creation, permission changes, or virtual filesystem edits.
Correlate admin API activity with the source IP; flag requests where the Referer is absent, cross-origin, or inconsistent with the administrator's normal workflow.
Monitor for child process creation by the HFS process following configuration-mutation requests, which suggests CSRF-to-RCE chaining.

Monitoring Recommendations

Enable verbose HFS request logging and forward logs to a central SIEM for retention and correlation.
Baseline legitimate administrator activity so anomalous admin GET requests stand out.
Track the installed HFS version across hosts and alert when versions 3.0.0 through 3.2.0 are detected.

How to Mitigate CVE-2026-61502

Immediate Actions Required

Upgrade Rejetto HFS to version 3.2.1 or later, which addresses the CSRF bypass. See the GitHub Release v3.2.1.
Restrict administrative interface access to trusted management networks using firewall or reverse-proxy rules.
Audit HFS user accounts, permissions, and configuration for unauthorized changes made prior to patching.

Patch Information

Rejetto released HFS 3.2.1 to remediate CVE-2026-61502. The patched release enforces the anti-CSRF check on all state-changing requests regardless of HTTP method. Installations that cannot upgrade immediately should apply the workarounds below and prioritize the upgrade window.

Workarounds

Log out of the HFS administrative interface when not actively managing the server to eliminate the authenticated browser session an attacker can hijack.
Bind the HFS admin interface to loopback only and require SSH port forwarding for administrative access, then remove default no-auth-from-localhost behavior by enforcing authentication for all admin endpoints.
Use a dedicated browser profile for HFS administration that does not browse untrusted content.
Place HFS behind a reverse proxy that strips or rejects GET requests to known admin API paths.

bash

# Configuration example: nginx reverse proxy rule blocking GET to admin API
location ~ ^/~/api/(set-config|add-account|change-password|set-vfs) {
    limit_except POST { deny all; }
    proxy_pass http://127.0.0.1:8080;
}