Cyber Resilience

CVE-2014-6287

CriticalCISA KEVActive ExploitationEUVD ExploitedPublic PoCRCE

Published: 07 October 2014

Published
07 October 2014
Modified
22 April 2026
KEV Added
25 March 2022
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.9436 100.0th percentile
Risk Priority 96 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2014-6287 is a critical-severity Code Injection (CWE-94) vulnerability in Rejetto Http File Server. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

The vulnerability is a code injection flaw (CWE-94) in the findMacroMarker function within parserLib.pas of Rejetto HTTP File Server (HFS or HttpFileServer) versions 2.3x prior to 2.3c. It is triggered when a %00 sequence is supplied in a search action, enabling execution of arbitrary programs on the underlying host. The issue carries a CVSS 3.1 base score of 9.8.

Unauthenticated remote attackers can exploit the flaw over the network by sending a crafted search request containing the null-byte sequence. Successful exploitation grants the ability to run arbitrary programs with the privileges of the HFS process, resulting in full compromise of confidentiality, integrity, and availability.

Public exploit code targeting this issue has been published repeatedly on PacketStorm, and the vulnerability is tracked in the CERT Vulnerability Note VU#251276. The supplied description indicates that upgrading to version 2.3c or later eliminates the affected code path.

EU & UK References

Vulnerability details

The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.

CWE(s)
CWE-94
KEV Date Added
25 March 2022

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

rejetto
http file server
2.3 — 2.3c

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly blocks the %00 null-byte sequence in search-action input that triggers arbitrary program execution in findMacroMarker.

SI-2 Flaw Remediation good match
prevent

Requires prompt application of the vendor fix (upgrade to 2.3c) that removes the vulnerable parser code path.

SC-7 Boundary Protection partial match
prevent

Boundary-protection rules can restrict unauthenticated network access to the HFS search interface, reducing exploit surface.

References