Allaire ColdFusion 4.0x CFCACHE Vulnerability
BID:917
Info
Allaire ColdFusion 4.0x CFCACHE Vulnerability
| Bugtraq ID: | 917 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Jan 04 2000 12:00AM |
| Updated: | Jan 04 2000 12:00AM |
| Credit: | Publicized in Allaire Security Bulletin ASB00-03, released January 4, 2000. |
| Vulnerable: |
Allaire ColdFusion Server 4.0.1 Allaire ColdFusion Server 4.0 |
| Not Vulnerable: |
Allaire ColdFusion Server 4.5 |
Discussion
Allaire ColdFusion 4.0x CFCACHE Vulnerability
ColdFusion 4.x includes a function called CFCACHE. This function improves server performance by caching the HTML output of processed CFM pages.
When the CFCACHE tag is used in a CFM page, it creates temporary files. Some of these files are .tmp files, which contain the actual HTML output. It also creates a cfcache.map file, which contains pointers to the .tmp files including absolute pathnames, timestamps, and other URL information. This information could be potentially harmful if exposed to the public. These files are all placed in the same web-accessible directory as the CFM file itself, and can be remotely accessed via an explicit URL.
ColdFusion 4.x includes a function called CFCACHE. This function improves server performance by caching the HTML output of processed CFM pages.
When the CFCACHE tag is used in a CFM page, it creates temporary files. Some of these files are .tmp files, which contain the actual HTML output. It also creates a cfcache.map file, which contains pointers to the .tmp files including absolute pathnames, timestamps, and other URL information. This information could be potentially harmful if exposed to the public. These files are all placed in the same web-accessible directory as the CFM file itself, and can be remotely accessed via an explicit URL.
Exploit / POC
Allaire ColdFusion 4.0x CFCACHE Vulnerability
For any cfm file, request the corresponding cfcache.map file.
For example, for the file:
http ://server/path/info.cfm
request:
http ://server/path/cfcache.map
The returned file will look something like this:
[info.cfm?product_id=9]
Mapping=C:\Inetpub\wwwroot\path\CFC155.tmp
SourceTimeStamp=10/06/1999 08:02:06 AM
For any cfm file, request the corresponding cfcache.map file.
For example, for the file:
http ://server/path/info.cfm
request:
http ://server/path/cfcache.map
The returned file will look something like this:
[info.cfm?product_id=9]
Mapping=C:\Inetpub\wwwroot\path\CFC155.tmp
SourceTimeStamp=10/06/1999 08:02:06 AM
Solution / Fix
Allaire ColdFusion 4.0x CFCACHE Vulnerability
Solution:
Allaire has released a new CFCACHE.CFM to remedy this problem. It can be downloaded at:
http://download.allaire.com/AllaireSecurityBulletin(ASB00-03)New4.0xCfcache.zip
This new .cfm has been included with ColdFusion 4.5, and allows the administrator to specify the location of the .tmp and cfcache.map files.
To implement this patch, take the following actions (quoted verbatim from Allaire Security Bulletin ASB00-03, referenced in its entirety in the credit section):
What Customers Should Do
Customers should make a backup copy of their existing CFCACHE.CFM file in the \CFUSION\BIN\CFTags\ directory, then download and copy the new CFCACHE.CFM file into their \CFUSION\BIN\CFTags\ directory, replacing the old CFCACHE.CFM file. They should then modify their site to make use of the new "CacheDirectory" attribute of the tag, specifying a directory that is not part of the web document directory structure and inaccessible to Internet clients. The format of the new attribute is:
<CFCACHE Action="CACHE"
CacheDirectory="D:\files\private\secure\cache">
Note that all tag attributes available to the previously released CFCACHE tag are still available in this new tag.
A sample of the new cfcache.map file is below:
[C:\Inetpub\wwwroot\index.cfm]
Mapping=D:\files\cache\CFC95.tmp
SourceTimeStamp=10/18/1999 02:14:28 AM
Customers should also closely monitor their web logs for browser HTTP requests for "cfcache.map" and "*.tmp" files as they would requests for files in the /cfdocs or /cfide/administrator directories, treating these requests as malicious reconnaissance probes.
Solution:
Allaire has released a new CFCACHE.CFM to remedy this problem. It can be downloaded at:
http://download.allaire.com/AllaireSecurityBulletin(ASB00-03)New4.0xCfcache.zip
This new .cfm has been included with ColdFusion 4.5, and allows the administrator to specify the location of the .tmp and cfcache.map files.
To implement this patch, take the following actions (quoted verbatim from Allaire Security Bulletin ASB00-03, referenced in its entirety in the credit section):
What Customers Should Do
Customers should make a backup copy of their existing CFCACHE.CFM file in the \CFUSION\BIN\CFTags\ directory, then download and copy the new CFCACHE.CFM file into their \CFUSION\BIN\CFTags\ directory, replacing the old CFCACHE.CFM file. They should then modify their site to make use of the new "CacheDirectory" attribute of the tag, specifying a directory that is not part of the web document directory structure and inaccessible to Internet clients. The format of the new attribute is:
<CFCACHE Action="CACHE"
CacheDirectory="D:\files\private\secure\cache">
Note that all tag attributes available to the previously released CFCACHE tag are still available in this new tag.
A sample of the new cfcache.map file is below:
[C:\Inetpub\wwwroot\index.cfm]
Mapping=D:\files\cache\CFC95.tmp
SourceTimeStamp=10/18/1999 02:14:28 AM
Customers should also closely monitor their web logs for browser HTTP requests for "cfcache.map" and "*.tmp" files as they would requests for files in the /cfdocs or /cfide/administrator directories, treating these requests as malicious reconnaissance probes.
References
Allaire ColdFusion 4.0x CFCACHE Vulnerability
References:
References: