CVE-2024-39943: rejetto HFS OS Command Execution Vulnerability
Summary
CVE-2024-39943: rejetto HFS vulnerable to OS Command Execution by remote authenticated users. Affects hfs versions < 0.52.10. Fixed in 0.52.10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
rejetto HFS (aka HTTP File Server) is a file sharing server software that allows users to share and download files over HTTP. It is commonly used for personal file sharing or as a lightweight web server. The vulnerability in rejetto HFS 3 before version 0.52.10 on Linux, UNIX, and macOS allows remote authenticated users with Upload permissions to execute arbitrary OS commands. This vulnerability arises due to the use of a shell to execute the 'df' command, which can be exploited by authenticated users to execute arbitrary commands on the server.
Vulnerability Detail
The vulnerability in rejetto HFS allows remote authenticated users to execute arbitrary OS commands if they have Upload permissions. This occurs because a shell is used to execute the 'df' command, which can be abused to execute arbitrary commands. An attacker with Upload permissions can exploit this vulnerability to execute malicious commands on the server, potentially leading to unauthorized access, data loss, or further compromise of the system.
How To Fix
Latest published version: 3.3.4 as of 23 Oct 2026
npm install hfs@3.3.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.52.10
This is the first release that contains the fix.
npm install hfs@0.52.10Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating to the latest version is not immediately feasible, users can mitigate the risk by removing Upload permissions for authenticated users. By restricting the ability to upload files, the potential for exploitation of this vulnerability is significantly reduced. However, this workaround may impact the intended functionality of the server, so updating to the latest version is still recommended.
Conclusion
The OS command execution vulnerability in rejetto HFS allows remote authenticated users to execute arbitrary commands on the server. To mitigate the risk, users should update to version 0.52.10 or later. If immediate updating is not possible, removing Upload permissions for authenticated users can reduce the risk. It is important to prioritize the security of the server to prevent unauthorized access and potential data loss.
See every vulnerability recorded for hfs →
FAQ
rejetto HFS is a file sharing server software that allows users to share and download files over HTTP. It is commonly used for personal file sharing or as a lightweight web server.
The vulnerability allows remote authenticated users with Upload permissions to execute arbitrary OS commands on the server. This can lead to unauthorized access, data loss, or further compromise of the system.
To fix this vulnerability, update rejetto HFS to version 0.52.10 or later. This version includes a fix for the OS command execution vulnerability.
If updating is not immediately feasible, you can remove Upload permissions for authenticated users to mitigate the risk. However, this may impact the intended functionality of the server.
You can download the latest version of rejetto HFS from the official rejetto HFS website.
Related vulnerabilities
Recent vulnerabilities recorded for hfs.
