Summary
CVE-2026-61500 is a critical unauthenticated remote code execution vulnerability in Rejetto HFS (HTTP File Server) versions 3.0.0 through 3.2.0, scoring 9.3 (CRITICAL) under CVSS v4.0. The flaw stems from the application deriving its session-cookie signing key from JavaScript’s non-cryptographic Math.random() generator while simultaneously leaking outputs of that same generator to unauthenticated clients during the login flow. An attacker can exploit this entirely over the network, with no credentials required, to forge an administrator session cookie and achieve remote code execution. Rejetto has released version 3.2.1 to address the issue.
Technical details
- Root cause: The session-cookie signing key is derived from
Math.random(), a non-cryptographic pseudo-random number generator (PRNG), classified under CWE-338 (Use of Cryptographically Weak Pseudo-Random Number Generator). Browser-grade PRNGs are predictable once a sufficient number of outputs are observed. - Trigger conditions: No authentication, no user interaction, and no special network position are required. The attack is entirely passive and opportunistic — the attacker only needs to send a small number of standard HTTP login requests to the exposed HFS instance.
- Attack chain:
- Attacker sends a small number of login requests to the target HFS instance.
- HFS login responses disclose
Math.random()outputs to the unauthenticated client. - Attacker collects these outputs and uses them to reconstruct the internal PRNG state.
- With the PRNG state recovered, the attacker derives the session-cookie signing key.
- Attacker forges a valid administrator session cookie.
- Using the forged administrator cookie, the attacker accesses the
server_codeconfiguration feature to execute arbitrary code on the server.
- Attack vector: Remote, over HTTP/HTTPS — no local access or network adjacency required.
- Impact: Full administrative access and unauthenticated remote code execution (RCE) on the host running HFS.
Affected software
- Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0 (all releases in this range are vulnerable)
Severity
- CVSS v4.0: 9.3 (CRITICAL) —
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS v3.1: 9.8 (CRITICAL) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate action — patch: Upgrade to Rejetto HFS 3.2.1 or later. The vendor confirmed in the v3.2.1 release that this version resolves security vulnerabilities in all prior versions that could allow an attacker to gain administrative access to HFS.
- If immediate patching is not feasible:
- Restrict access to the HFS instance at the network perimeter — do not expose HFS directly to the internet.
- Apply firewall or reverse-proxy rules to limit login endpoint access to trusted IP ranges only.
- Monitor for anomalous or repeated unauthenticated login attempts in HFS access logs, which may indicate active PRNG state reconstruction attempts.
IONIX Status
The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.