## https://sploitus.com/exploit?id=E2B1FEDB-EE32-569C-8715-85BA172AE707
# CVE-2024-23692-poc
CVE-2024-23692 is a template injection vulnerability that affects Rejetto’s HTTP File Server (HFS) version 2.3m and earlier. This vulnerability allows remote unauthorized attackers to execute arbitrary commands on affected systems by sending specially crafted HTTP requests.
**Vulnerability Mechanism:**
HFS uses a default template when processing HTTP responses, which includes search query parameters from the request. These parameters are not properly escaped, leading to a Server-Template Injection (SSTI) vulnerability. Attackers can exploit this vulnerability by constructing carefully crafted requests that use unescaped symbols and macros to inject arbitrary commands and execute them on the server.
**Consequences:**
An attacker who successfully exploits this vulnerability can execute arbitrary code on the affected server, potentially causing the following consequences:
- **Data leakage:** Attackers may access or steal sensitive information.
- **Data tampering:** Attackers may modify or delete important data.
- **Service disruption:** Attackers may cause server crashes or denial-of-service attacks.
- **Malware deployment:** Attackers may install malware, such as ransomware or mining programs, on the server.
Since the HFS 2.3m version is no longer officially supported, it is recommended that users upgrade to HFS 3.x to avoid being vulnerable to this vulnerability.
