Rejetto HFS User Enumeration via Login Endpoint

Executive Summary

CVE-2026-61503 is a vulnerability in Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.0. It allows an unauthenticated remote attacker to determine whether a submitted username exists by observing differences in the server's login endpoint responses.

This is a username enumeration vulnerability, meaning attackers can confirm valid account names, including the default admin account. This information can then be used to facilitate further attacks, such as password-guessing or session-forgery attacks.

The vulnerability stems from observable discrepancies in the server's responses (CWE-204), where the login endpoint behaves differently depending on whether the username is valid or not.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by observing differences in the server's login endpoint responses when submitting valid versus invalid usernames. An attacker or defender can send login requests with various usernames and analyze the responses to determine if a username exists based on observable discrepancies.

To detect this vulnerability, you can use tools like curl or Burp Suite to send HTTP POST requests to the HFS login endpoint and compare the responses. Below are example commands using curl:

• Send a request with a likely invalid username: curl -X POST http://<HFS_SERVER_IP>:<PORT>/login -d 'username=nonexistentuser&password=test'
• Send a request with a likely valid username (e.g., 'admin'): curl -X POST http://<HFS_SERVER_IP>:<PORT>/login -d 'username=admin&password=test'

Compare the responses. If the server returns different error messages or response lengths for valid versus invalid usernames, the system is likely vulnerable to username enumeration.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you in several ways if you are using an affected version of Rejetto HFS (3.0.0 through 3.2.0):

• Attackers can identify valid usernames, including the default admin account, which increases the risk of targeted attacks.
• Once valid usernames are confirmed, attackers may launch password-guessing attacks to gain unauthorized access to the server.
• The vulnerability can enable session-forgery attacks, where attackers hijack or manipulate user sessions to gain control over the server.
• If the server contains sensitive data, unauthorized access could lead to data breaches, data manipulation, or service disruption.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can affect compliance with common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): If the server processes or stores personal data of EU citizens, a successful attack exploiting this vulnerability could lead to unauthorized access to that data. This may result in a data breach, triggering GDPR's reporting requirements and potential fines for failing to protect personal data adequately.
• HIPAA (Health Insurance Portability and Accountability Act): If the server handles protected health information (PHI), unauthorized access due to this vulnerability could constitute a breach under HIPAA. This may require notification to affected individuals and regulatory authorities, along with potential penalties for non-compliance.
• Other standards like PCI DSS (Payment Card Industry Data Security Standard): If the server processes payment card data, this vulnerability could lead to non-compliance with PCI DSS requirements for securing authentication mechanisms and protecting cardholder data.

Overall, the vulnerability undermines the security controls required by these regulations, potentially leading to legal, financial, and reputational consequences.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation for this vulnerability is to upgrade Rejetto HFS to version 3.2.1 or later, as the issue has been addressed in this release.

• Download and install the latest version of HFS from the official repository: https://github.com/rejetto/hfs/releases/tag/v3.2.1

If upgrading is not immediately possible, consider the following temporary measures:

• Disable or restrict access to the login endpoint to trusted networks or IP addresses.
• Implement rate limiting on the login endpoint to hinder brute-force or enumeration attempts.
• Monitor login attempts for unusual activity, such as repeated failed attempts with different usernames.

Additionally, ensure that default admin accounts are either disabled or have strong, unique passwords to reduce the risk of successful attacks.

Useful 0 Not Useful 0