Beyond generic listing, traversal, and upload issues, specific file-server products have shipped their own serious vulnerabilities, frequently unauthenticated and giving direct code execution. The notable patterns:
- HFS (HTTP File Server): template and expression injection in its request handling has given unauthenticated remote code execution; its macro/template engine is the locus.
- NAS web UIs: the web interfaces of consumer and SMB NAS devices have repeatedly carried authentication bypass, path traversal, and command injection flaws reachable pre-auth, leading to device root.
- General file-server apps: command injection in features that shell out (archive handling, media processing) and traversal/upload flaws beyond the generic cases.
Fingerprint and match#
# identify the product and version, then match to its advisory
curl -sI http://<target>:<port>/ # Server header and app-specific headers
curl -s http://<target>:<port>/ | grep -iE 'hfs|version|powered by'
whatweb http://<target>:<port>/ 2>/dev/null
Identify the exact product and version from the Server header, page content, and fingerprinting, then match to the known vulnerability for that build. Many of these are unauthenticated, so reaching the interface is the main precondition; the product-specific exploit (template injection, command injection, auth bypass) is then the direct route.
Exploitation notes#
- Product identification is the key step: the generic surfaces (listing, traversal, upload) apply everywhere, but the highest-impact path is often a product-specific unauthenticated RCE that a version match reveals.
- HFS and similar lightweight servers with macro/template engines are prone to injection in that engine; NAS web UIs are prone to pre-auth traversal and command injection.
- Combine with the generic techniques: a product may lack a known CVE but still fall to its upload or traversal behaviour, see File upload to RCE and Path traversal.