Adobe Coldfusion
Last updated
Was this helpful?
Last updated
Was this helpful?
ColdFusion is basically just yet another commercial web application development platform. The programming language used with that platform is also commonly called ColdFusion, but the correct name of it is .
Vulnerabilities against ColdFusion application are the typical ones so you can find Local File Disclosure (LFD), SQL injection and Cross-site Scripting as well.
And of course, ColdFusion by default runs as NT-Authority\SYSTEM (Windows) or nobody (Linux), thus making the ColdFusion+Windows combination a very desirable target.
Source:
In unpatched versions of ColdFusion 6, 7 and 8 there is a local file inclusion vulnerability () which you can exploit to get the administrator password hash from the password.properties file.
ColdFusion 6:
ColdFusion 7:
ColdFusion 8:
All versions (according to [3], but I have never tried it):
If the local file inclusion is successful, the password hash (SHA1) is written back to you on the administrative login page like this (hash was reducted):
Once we gain access to the administration panel we can upload a CFM shell.
Go to the Debugging & Loging / Scheduled Taks menu element
Add a scheduled task that would download our CFML script from our webserver to the ColdFusion server’s webroot.
Make sure you schedule the deployment to some reasonable time, so 5-10 minutes from your current time
Here is an example on how it looks like:
You can find a few CFML shells
And it looks like this once it is uploaded (I had to use the Options fields to fit in the screenshot):
Once you have access to the administrative panel, you can also get the connection strings and credentials to databases connected to ColdFusion.
For ColdFusion 6 and 7 the passwords for DataSources encrypted in the following XML files:
For ColdFusion 8, 9 and 10:
The most important thing is that by decompiling
\lib\cfusion.jar and looking at the \coldfusion\sql\DataSourceDef.class
You can find the seed for the key (“0yJ!@1$r8p0L@r1$6yJ!@1rj”) and algorithm (3DES and then Base64 encoding) used.
In case of ColdFusion 6, 7 and 8, the encrypted passwords can be found just by looking at the page source of the individual data sources on the administrative panel (on ColdFusion 9 and 10 this was fixed and you will only see ******** in the page source for the passwords).
No matter how you obtain the encrypted passwords, you can decrypt them with openSSL like this:
You might also consider using Metasploit to exploit some of the above vulnerabilities:
Depending again on the ColdFusion version, the credentials are stored in different places, but you might be able to retrieve the passwords from the administrative panel as well!
