~ / search / GHSA-5f4x-hwv2-w9w2

GHSA-5f4x-hwv2-w9w2

rejetto HFS vulnerable to OS Command Execution by remote authenticated users

Source: GitHub Advisory Database (reviewed) High CVE-2024-39943

Packages

EcosystemPackageAffectedFixed in
npm hfs < 0.52.10 0.52.10

Details

As written in the advisory (Markdown source, shown as plain text).

rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). This occurs because a shell is used to execute df (i.e., with execSync instead of spawnSync in child_process in Node.js).

References

External links from the advisory. They lead to third-party sites.