BID:115

Allaire ColdFusion Remote File Display, Deletion, Upload and Execution Vulnerability

Info

Allaire ColdFusion Remote File Display, Deletion, Upload and Execution Vulnerability

Bugtraq ID:	115
Class:	Origin Validation Error
CVE:	CVE-1999-0455 CVE-1999-0477
Remote:	Yes
Local:	Yes
Published:	Dec 25 1998 12:00AM
Updated:	Jul 11 2009 12:16AM
Credit:	rain.forest.puppy <[email protected]> made public the ability to display and delete any file on the system in Phrack Issue 54 Article 8. [email protected] made public the ability to upload and execute arbitrary ColdFusion files in a L0pht advisory. Ad
Vulnerable:	Allaire ColdFusion Server 4.0 Allaire ColdFusion Server 3.1.2 Allaire ColdFusion Server 3.1.1 Allaire ColdFusion Server 3.1 Allaire ColdFusion Server 3.0.1 Allaire ColdFusion Server 3.0 Allaire ColdFusion Server 2.0

Not Vulnerable:	Allaire ColdFusion Server 4.0.1

Discussion

Allaire ColdFusion Remote File Display, Deletion, Upload and Execution Vulnerability

A security vulnerability allows remote web users to delete and display any file in the system, as well as possibly allow the upload and execution of ColdFusion files.

A default installation of Cold Fusion Server includes sample code and documentation that is available to web browsing users. One of these sample applications, the expression evaluator, allows users to experiment with ColdFusion expressions. It gives you the option to upload a file, which it will the process and display and subsequently delete. Normally access to the application is restricted to the local machine. However, some pages in the application can be acessed directly. By passing it a handcrafted URL you can order it to display and delete any file on the system.

The expression calculator is composed of several files. openfile.cfm and openedfile.cfm allows you to upload a file to the sever. exprcalc.cfm processes the uploaded file, displays it and then deletes it.

By using exprcacl.cfm to delete itself we can upload a file to the server that will not be deleted which we can then try to execute.

Exploit / POC

Allaire ColdFusion Remote File Display, Deletion, Upload and Execution Vulnerability

To display and delete any file on the system use an URL of the following form:

http://www.victim.test/cfdocs/expeval/ExprCalc.cfm?OpenFilePath=C:\the\target\file

To upload files to the sever first find out the location of the sample code on the server by uploading a dummy file by using http://www.victim.test/cfdocs/expeval/openfile.cfm. After uploading a dummy file it will be displayed for you. The URL will be for the form:

http://www.victim.test/cfdocs/expeval/ExprCalc.cfm?RequestTimeout=2000&OpenFilePath=C:\Inetpub\wwwroot\cfdocs\expeval\.\dummy.txt

Now replace the "dummy.txt" string by "ExprCalc.cfm" to delete that file. We can now upload and execute ColdFusion files in the server without them being deleted.

/data/vulnerabilities/exploits/mole.cfm
/data/vulnerabilities/exploits/

Solution / Fix

Allaire ColdFusion Remote File Display, Deletion, Upload and Execution Vulnerability

Solution:
Use one of the following solutions:

1. Remove the documentation directory (CFDOCS) from the server (this will not affect functionality of the server).

2. Install the ColdFusion Server 4.0.1 Update, available for download from the DevCenter:
http://www.allaire.com/developer
(Note the 4.0.1 Update requires ColdFusion Server 4.0.)

3: For versions of ColdFusion prior to 4.0, Allaire has released a patch that requires requests for the .cfm files in question to originate from the local host in order to be processed.

Allaire ColdFusion Server 2.0