Rejetto HFS Basic Listing Cross-Site Scripting via File Name

Executive Summary

This vulnerability is a stored cross-site scripting (XSS) issue in Rejetto HFS versions 3.0.0 through 3.2.0. The software does not properly escape file names when generating its fallback 'basic' web listing.

An attacker with upload permissions—or an anonymous user if the server has an open upload folder—can upload a file with a name containing malicious script code. When other users view the web listing (which can be forced by appending ?get=basic to the URL), the script executes in their browsers.

• Affected versions: 3.0.0 to 3.2.0
• Vulnerability type: Stored XSS (CWE-79)
• CVSS v4.0 BaseScore: 5.1 (Medium severity)

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability on your network or system, you can check if your Rejetto HFS server is running a vulnerable version (3.0.0 through 3.2.0).

• Verify the version of Rejetto HFS installed on your system. If it falls within the range of 3.0.0 to 3.2.0, it is likely vulnerable.

You can also manually test for the vulnerability by attempting to trigger the 'basic' web listing feature.

• Append the ?get=basic parameter to the HFS server URL in a browser (e.g., http://[HFS-server-address]/?get=basic). If the listing displays file names without proper escaping, the vulnerability may be present.

Additionally, inspect uploaded files for suspicious names containing script tags or other malicious payloads. Look for files with names like <script>alert(1)</script>.txt or similar.

• Use a web vulnerability scanner or XSS detection tool to automate the process of identifying unescaped file names in the web listing.

Useful 0 Not Useful 0

Impact Analysis

If you are a user of Rejetto HFS (versions 3.0.0 to 3.2.0), this vulnerability could allow an attacker to execute malicious scripts in your browser when you view a compromised file listing.

• Potential impacts include: session hijacking, theft of sensitive data (e.g., cookies, credentials), or redirection to malicious websites.
• If you are an administrator, an attacker could exploit this to target other users of your HFS server, compromising their accounts or spreading malware.

The attack requires the victim to view the 'basic' web listing, which can be forced via the ?get=basic URL parameter.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could have compliance implications depending on the data handled by the affected HFS server.

• GDPR: If the server stores or processes personal data of EU citizens, a successful XSS attack could lead to unauthorized access or disclosure of that data, violating GDPR requirements for data protection and confidentiality (Articles 5, 32).
• HIPAA: If the server is used in a healthcare environment to store or share protected health information (PHI), an XSS attack could result in unauthorized access to PHI, violating the HIPAA Security Rule (45 CFR Part 164, Subpart C).
• Other standards: This vulnerability may also violate requirements in frameworks like ISO 27001 (A.12.6.1 - Management of technical vulnerabilities) or PCI DSS (Requirement 6.5.7 - Address common coding vulnerabilities, including XSS).

Organizations should assess whether this vulnerability exposes them to non-compliance risks based on their specific use of Rejetto HFS and the data it handles.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade Rejetto HFS to the latest version if a patch is available. Check the official Rejetto HFS website or vulnerability advisories for updates.
• If upgrading is not immediately possible, disable the 'basic' web listing feature to prevent exploitation. This can be done by removing or restricting access to the ?get=basic parameter.
• Restrict upload permissions to trusted users only. Disable anonymous uploads if they are enabled on your server.
• Regularly audit uploaded files for suspicious names or content. Remove any files with names containing scripts or other malicious payloads.
• Implement a web application firewall (WAF) to filter out malicious requests targeting the vulnerable feature.
• Monitor your server logs for unusual activity, such as requests containing the ?get=basic parameter or attempts to upload files with suspicious names.

Useful 0 Not Useful 0