Unauthenticated Remote Code Execution in HFS2 via Template Injection

HFS2 version 2.4.0 and earlier contains a template injection vulnerability within its multipart upload handler. An unauthenticated attacker can exploit this flaw by crafting a filename containing a malicious template quoting sequence followed by an exec macro. This vulnerability allows the attacker to bypass authorization checks within the application's dispatcher mechanism, resulting in remote code execution (RCE) on the underlying host system. Given the nature of the flaw, successful exploitation leads to full compromise of the server. Organizations running affected versions of HFS2 are at high risk and should prioritize remediation or apply necessary access controls to restrict access to the upload functionality until a patch is applied.

Impact

Successful exploitation results in arbitrary remote code execution on the host system, granting the attacker the permissions of the user running the HFS2 application. This vulnerability poses a severe threat to any environment hosting HFS2, potentially leading to total system takeover, data exfiltration, and further lateral movement within the network.

Recommendation

Prioritize the upgrade of all HFS2 installations to a patched version beyond 2.4.0. If immediate patching is not possible, restrict access to the multipart upload endpoint at the web application firewall or reverse proxy layer until remediation is complete.