{"id":"CVE-2014-6287","published":"2014-10-07T10:55:04Z","modified":"2026-06-17T00:12:50Z","title":"Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability","vendor":"Rejetto","product":"HTTP File Server (HFS)","tier":"core","eol":null,"description":{"text":"The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.","provenance":"source","from":"NVD"},"summary":{"text":"The Rejetto HTTP File Server (HFS, also known as HttpFileServer) 2.3x series prior to 2.3c contains a flaw in the findMacroMarker function in parserLib.pas that allows improper control of code generation. An attacker with network access can exploit it without authentication or user interaction by sending a search action containing a %00 sequence, causing the server to execute arbitrary programs.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:36:12Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99323,"percentile":0.99938,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2022-03-25","dueDate":"2022-04-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2014-6287","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-06-03","exploitedFirstSeen":"2019-06-03","ransomware":false,"evidence":[{"url":"https://www.trendmicro.com/en_us/research/19/f/blacksquid-slithers-into-servers-and-drives-with-8-notorious-exploits-to-drop-xmrig-miner.html","date":"2019-06-03"},{"url":"https://s.tencent.com/research/report/737.html","date":"2019-06-11"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/vulnerabilities-exploits-and-malware-driving-attack-campaigns-in-november-2019","date":"2019-12-24"},{"url":"https://unit42.paloaltonetworks.com/lucifer-new-cryptojacking-and-ddos-hybrid-malware/","date":"2020-06-24"},{"url":"https://research.checkpoint.com/2020/rudeminer-blacksquid-and-lucifer-walk-into-a-bar/","date":"2020-09-15"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-25"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/sensor-intel-series-top-cves-august-2024","date":"2024-09-19"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/botpoke-scanner-switches-ip","date":"2024-11-25"},{"url":"https://www.f5.com/labs/articles/threat-intelligence/continued-scanning-for-cve-2023-1389","date":"2025-01-21"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-09-16&host_type=src&vulnerability=cve-2014-6287","date":"2026-09-16"}],"evidenceTotal":23,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.kb.cert.org/vuls/id/251276","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/3793","tags":["Exploit"]},{"url":"https://www.exploit-db.com/exploits/39161/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.kb.cert.org/vuls/id/251276","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://github.com/rapid7/metasploit-framework/pull/3793","tags":["Exploit"]},{"url":"https://www.exploit-db.com/exploits/39161/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-6287","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Remote unauthenticated exploit via public-facing web app","mappingType":"uncategorized","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary programs via a %00 sequence in a search action","start":119,"end":210}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Direct arbitrary program execution on server","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote attackers to execute arbitrary programs","start":119,"end":172}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2014-6172","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-6172","exploited":true,"exploitedSince":"2022-03-25","provenance":"source"},"exploits":[{"id":34668,"url":"https://www.exploit-db.com/exploits/34668","title":"Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (1)","type":"remote","platform":"windows","date":"2014-09-15","verified":true,"provenance":"source"},{"id":34926,"url":"https://www.exploit-db.com/exploits/34926","title":"Rejetto HTTP File Server (HFS) - Remote Command Execution (Metasploit)","type":"remote","platform":"windows","date":"2014-10-09","verified":true,"provenance":"source"},{"id":39161,"url":"https://www.exploit-db.com/exploits/39161","title":"Rejetto HTTP File Server (HFS) 2.3.x - Remote Command Execution (2)","type":"remote","platform":"windows","date":"2016-01-04","verified":true,"provenance":"source"},{"id":49125,"url":"https://www.exploit-db.com/exploits/49125","title":"Rejetto HttpFileServer 2.3.x - Remote Command Execution (3)","type":"webapps","platform":"windows","date":"2020-11-30","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":4,"earliest":"2014-09-15"},"pocGithub":{"count":11,"skipped":2,"earliest":"2019-12-27","earliestUrl":"https://github.com/roughiz/cve-2014-6287.py","repos":[{"name":"randallbanner/Rejetto-HTTP-File-Server-HFS-2.3.x---Remote-Command-Execution","url":"https://github.com/randallbanner/Rejetto-HTTP-File-Server-HFS-2.3.x---Remote-Command-Execution","stars":2,"created":"2023-04-04"},{"name":"Nicoslo/Windows-exploitation-Rejetto-HTTP-File-Server-HFS-2.3.x-CVE-2014-6287","url":"https://github.com/Nicoslo/Windows-exploitation-Rejetto-HTTP-File-Server-HFS-2.3.x-CVE-2014-6287","stars":1,"created":"2021-02-20"},{"name":"mrintern/thm_steelmountain_CVE-2014-6287","url":"https://github.com/mrintern/thm_steelmountain_CVE-2014-6287","stars":1,"created":"2021-12-03"},{"name":"roughiz/cve-2014-6287.py","url":"https://github.com/roughiz/cve-2014-6287.py","stars":0,"created":"2019-12-27"},{"name":"zhsh9/CVE-2014-6287","url":"https://github.com/zhsh9/CVE-2014-6287","stars":0,"created":"2024-03-06"}]},"metasploit":[{"name":"Rejetto HttpFileServer Remote Command Execution","module":"exploit/windows/http/rejetto_hfs_exec","type":"exploit","disclosureDate":"2014-09-11","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/rejetto_hfs_exec.rb"}],"nuclei":[{"id":"CVE-2014-6287","name":"HTTP File Server <2.3c - Remote Command Execution","severity":"critical","path":"http/cves/2014/CVE-2014-6287.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2014/CVE-2014-6287.yaml"}],"first":{"date":"2014-09-11","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/rejetto_hfs_exec.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"Rejetto HTTP File Server RCE","id":"a133193c-2daa-4a29-8022-018695fcf0ae","level":"high","status":"test","path":"rules-emerging-threats/2014/Exploits/CVE-2014-6287/web_cve_2014_6287_hfs_rce.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2014/Exploits/CVE-2014-6287/web_cve_2014_6287_hfs_rce.yml","techniques":["T1190","T1505.003"]}]},"exploitRefs":["http://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html","http://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Execution.html","http://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execution.html","http://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.html","https://github.com/rapid7/metasploit-framework/pull/3793","https://www.exploit-db.com/exploits/39161/"],"flow":[{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1190"],"provenance":"source"}],"timeline":[{"date":"2014-09-11","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2014-09-15, PoC-in-GitHub 2019-12-27","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/rejetto_hfs_exec.rb","provenance":"source"},{"date":"2014-10-07","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-6287","provenance":"source"},{"date":"2019-06-03","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.trendmicro.com/en_us/research/19/f/blacksquid-slithers-into-servers-and-drives-with-8-notorious-exploits-to-drop-xmrig-miner.html","provenance":"source"},{"date":"2022-03-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-6172","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":2726},"priority":{"score":69.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2706 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9994"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"6 NVD references tagged Exploit; 4 Exploit-DB entries; 11 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}