CVE-2014-6287
Rejetto HTTP File Server (HFS) Remote Code Execution Vulnerability
Published Oct 7, 2014 · updated Jun 16, 2026 · rejetto http file server
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.
Timeline
Detection, updates, and resolution for this record.
Oct 7, 2014 · Catalog
Detected
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.
Mar 25, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Apr 15, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.
Required action
Apply updates per vendor instructions.
CISA due date Apr 15, 2022
Affected
- cpe rejetto/http file serverversion unspecified
- vendor Rejetto HTTP File Server (HFS)version unspecified
Sources
- CISA KEVCVE-2014-6287
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (HFS or HttpFileServer) allows remote attackers to execute arbitrary programs.
cisa.gov - CVE.orgCVE-2014-6287
Official CVE identifier
cve.org - FIRST EPSSCVE-2014-6287
30-day exploitation probability 99.3%
first.org - Exploit Database34668
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database34926
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit Database39161
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_windows/http/rejetto_hfs_exec
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2014-6287
The findMacroMarker function in parserLib.pas in Rejetto HTTP File Server (aks HFS or HttpFileServer) 2.3x before 2.3c allows remote attackers to execute arbitrary programs via a %00 sequence in a search action.
nvd.nist.gov - Packet Storm Securityhttp://packetstormsecurity.com/files/128243/HttpFileServer-2.3.x-Remote-Command-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/135122/Rejetto-HTTP-File-Server-2.3.x-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/160264/Rejetto-HttpFileServer-2.3.x-Remote-Command-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm Securityhttp://packetstormsecurity.com/files/161503/HFS-HTTP-File-Server-2.3.x-Remote-Code-Execution.html
Packet Storm link already published on the finding.
packetstormsecurity.com