Attackers Target Rejetto HFS Flaw That Enables Admin Session Forgery and RCE
Summary: Rejetto HTTP File Server versions 3.0.0 through 3.2.0 derive their session-cookie signing key from JavaScript's non-cryptographic Math.random() generator and expose outputs of the same generator to unauthenticated clients during the SRP login handshake, letting an attacker reconstruct the PRNG state, recover the key, and forge an administrator session cookie. VulnCheck detected exploitation attempts on October 1, 2026, a day after Horizon3.ai published additional details, with a single China Telecom IP probing Canary deployments in Japan and the United States; a patch shipped in July 2026 in version 3.2.1, and a Python-based proof-of-concept was released publicly in late September by researcher Alejandro Ramos.
Key Takeaway: The patch existed for roughly three months before a public proof-of-concept appeared, and exploitation attempts followed within a day of the technical details going out - a window that closes only if the upgrade happens before the write-up, not after. This is the second Rejetto HFS flaw to see active exploitation, after CVE-2024-23692 was used in 2024 to deliver cryptocurrency miners, trojans, and HATVIBE malware.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-23692CVE-2026-61500
- Related
- CVE-2024-23692: Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability Known Exploited Vulnerabilities · Jul 09, 2024Anthropic Expands Claude Access for Vetted Cyber Teams as Glasswing Finds 129,000 Flaws Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026