Session Key Forgery in Rejetto HFS via Math.random() Predictability

Executive Summary

CVE-2026-61500 is a vulnerability in Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.0. The application uses a non-cryptographic function called Math.random() to generate the signing key for session cookies. This function is predictable and not designed for security purposes.

During the login process, the application also exposes outputs of this Math.random() generator to unauthenticated clients. An attacker can collect a small number of these login responses to reconstruct the generator's internal state. Once the state is reconstructed, the attacker can recover the signing key used for session cookies.

With the signing key, the attacker can forge a valid administrator session cookie. This forged cookie grants full administrative access to the server, allowing the attacker to execute remote code via the server_code configuration feature.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your network or system, you can check the version of Rejetto HFS running. The vulnerability affects versions 3.0.0 through 3.2.0. You can verify the version by accessing the HFS web interface or checking the server's response headers.

• Check the HFS version via the web interface: Open a browser and navigate to the HFS server. The version is often displayed in the footer or about section.
• Inspect HTTP response headers: Use a tool like curl or a browser's developer tools to inspect the 'Server' header in responses from the HFS server. Example command: curl -I http://<HFS_SERVER_IP>
• Look for exposed Math.random() outputs: The vulnerability involves the exposure of Math.random() outputs during login. You can attempt to log in and inspect the responses for patterns or values that resemble outputs from a non-cryptographic random number generator.

If the version is between 3.0.0 and 3.2.0, the system is vulnerable. No specific commands are provided for reconstructing the generator's state or forging session cookies, as this requires deeper analysis of the login responses.

Useful 0 Not Useful 0

Impact Analysis

If you are using an affected version of Rejetto HFS (3.0.0 through 3.2.0), this vulnerability can have severe consequences for you.

• An attacker can gain full administrative access to your HFS server without needing any prior authentication.
• Once administrative access is obtained, the attacker can execute arbitrary remote code on your server, potentially taking complete control of the system.
• This could lead to data theft, unauthorized modifications, or disruption of services hosted on the server.
• The attacker may also use the compromised server as a launchpad for further attacks within your network.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can significantly impact compliance with common standards and regulations, depending on the type of data and systems involved.

• GDPR (General Data Protection Regulation): If the HFS server processes or stores personal data of EU citizens, a breach resulting from this vulnerability could lead to unauthorized access or disclosure of that data. This may violate GDPR requirements for data protection and breach notification, potentially resulting in fines or legal action.
• HIPAA (Health Insurance Portability and Accountability Act): If the server handles protected health information (PHI), exploitation of this vulnerability could lead to unauthorized access to PHI. This would constitute a breach under HIPAA, requiring notification and potentially leading to penalties.
• Other standards (e.g., PCI DSS, ISO 27001): If the server is part of a payment processing environment or adheres to information security management standards, this vulnerability could violate requirements for secure authentication, access control, and protection against unauthorized code execution.

Failure to mitigate this vulnerability could result in non-compliance with these regulations, leading to legal, financial, or reputational consequences.

Useful 0 Not Useful 0

Mitigation Strategies

The most effective mitigation for this vulnerability is to upgrade Rejetto HFS to version 3.2.1 or later, as this version addresses the issue.

• Upgrade HFS: Download and install the latest version of HFS from the official GitHub repository. The patched version is 3.2.1 or later.
• Restrict access: If upgrading is not immediately possible, restrict access to the HFS server to trusted networks or IP addresses to reduce the risk of exploitation.
• Monitor network traffic: Watch for unusual login attempts or patterns that might indicate an attacker is attempting to exploit the vulnerability.
• Disable unnecessary features: Temporarily disable features like server_code configuration if they are not required, as these can be used for remote code execution if the vulnerability is exploited.

Useful 0 Not Useful 0