Skip to content
OpenAdvisories
Critical · 9.9 Public exploit CVE-2024-39943 EUVD-2024-2262GHSA-5f4x-hwv2-w9w2

rejetto HFS vulnerable to OS Command Execution by remote authenticated users

Published Jul 4, 2024 · Updated Aug 2, 2024 · Assigned by mitre

Package: hfs Ecosystem: npm

Description

rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • JenmrR/Node.js-CVE-2024-39943 ★ 0 · Apr 19, 2025
  • Heyholiday067/CVE-2024-39943-Poc ★ 0 · Jul 5, 2024

    CVE-2024-39943 rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs b…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm hfs < 0.52.10 0.52.10 GHSA-5f4x-hwv2-w9w2

References