CVE-2024-39943: OS Command Injection
rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in childprocess in Node.js).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/hfsto a version that resolves this vulnerability.Fixed in 0.52.10
Event History
Frequently Asked Questions
What is the severity of CVE-2024-39943?
CVE-2024-39943 is classified with a high severity due to its potential for remote OS command execution.
How do I fix CVE-2024-39943?
To fix CVE-2024-39943, update Rejetto HFS to version 0.52.10 or later.
Who is affected by CVE-2024-39943?
CVE-2024-39943 affects users of Rejetto HFS versions prior to 0.52.10 running on Linux, UNIX, or macOS.
What type of vulnerability is CVE-2024-39943?
CVE-2024-39943 is an OS command execution vulnerability that allows remote authenticated users to execute commands.
What are the conditions for exploiting CVE-2024-39943?
To exploit CVE-2024-39943, an attacker must have upload permissions as a remote authenticated user.