Rejetto HFS vulnerabilities

The vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 derives the session-cookie signing key from the non-cryptographic Math.random() generator and discloses its outputs to unauthenticated clients during login. A remote attacker can collect a few login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.

A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 allows a remote unauthenticated attacker to read JSON files outside shared folders by manipulating the 'lang' query parameter. Exploitation is limited to files with a narrow naming and format pattern, reducing practical impact.

A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 allows XSS attacks due to improper escaping of file names in the basic web listing. An attacker with upload permissions or an anonymous user can upload a file with a malicious name that executes a script in the victim's browser.

Rejetto HFS versions 3.0.0 through 3.2.0 return observably different responses from its login endpoint depending on whether the submitted username exists. A remote unauthenticated attacker can use this to confirm valid account names, including the default admin account.

A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 allows state-changing API requests via the GET method, which is exempt from anti-CSRF header checks. A remote attacker can perform administrative actions including account creation and configuration changes leading to code execution.

A vulnerability in Rejetto HFS versions 3.0.0 through 3.2.0 renders log entries in the administration panel as HTML without sanitization. A remote unauthenticated attacker can submit a failed login with a crafted username that is written to the error log and executes JavaScript in an administrator's browser when the logs are viewed.