CVE-2014-6287

CVE-2014-6287 is an unauthenticated remote code execution flaw in Rejetto HTTP File Server (HFS), a freeware file-sharing web server for Windows: the findMacroMarker function in parserLib.pas mishandles parsing of template macros, allowing code injection (CWE-94). An attacker triggers it by sending a crafted HTTP request whose specially crafted macro/special characters break out of the template parser, causing HFS to execute arbitrary commands or programs on the host. Successful exploitation yields command execution with the privileges of the HFS process, which is typically enough to install malware, ransomware, DDoS botnet components, or cryptocurrency miners on Windows systems. Any Windows host running Rejetto HFS is affected, particularly instances exposed directly to the internet; the source data does not list specific vulnerable version ranges. Exploitation is confirmed: the flaw was added to CISA's KEV on 2022-03-25 and carries a 99.3% EPSS (100th percentile), and related news links HFS exploitation to multi-exploit Windows malware campaigns such as the Lucifer DDoS botnet and the BlackSquid crypto-mining malware.

What to do: Upgrade HFS to the current vendor release (public advisories identify 2.3c, build 298, as the fixed build) per vendor instructions, as required by the CISA KEV action. If updating is not immediately possible, remove or restrict direct internet exposure (firewall the HFS port or place the service behind VPN/authentication) and review affected hosts for signs of compromise, such as unexpected cmd.exe/PowerShell child processes, new miner or botnet binaries, and unusual outbound traffic.