Executive brief
Rejetto HFS, a popular file-sharing server, contains a flaw that allows unauthorized individuals to identify valid usernames on the system. By observing differences in how the login page responds to various inputs, an attacker can confirm which accounts exist, including administrative ones. This information significantly simplifies subsequent attacks, such as password guessing or attempts to hijack user sessions.
Technical details
A username enumeration vulnerability exists in Rejetto HFS versions 3.0.0 through 3.2.0 due to an observable response discrepancy (CWE-204) at the login endpoint. A remote, unauthenticated attacker can distinguish between valid and invalid usernames based on the server's response behavior. This allows for the discovery of valid account names, including the default 'admin' account, which can be leveraged for targeted brute-force or session-forgery attacks. The issue is resolved in version 3.2.1.
Affected products
- Rejetto HFS (HTTP File Server) 3.0.0 through 3.2.0
Timeline
- 2026-07-13: advisory: NVD and VulnCheck published the advisory.
- 2026-07-13: patched: Version 3.2.1 released to address the vulnerability.