jetlib.sec » Tags » coldfusion

Feeds

133351 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

42 items tagged "coldfusion"

Related tags: disclosure [+], directory [+], cve [+], vulnerability [+], password properties [+], directory traversal [+], security [+], directory traversal vulnerability [+], denial of service [+], cross site scripting [+], vulnerabilities [+], probe [+], information disclosure [+], encrypted password [+], denial [+], application [+], whitepaper [+], web application development [+], web [+], usa [+], unspecified [+], server configurations [+], security issues [+], security advisory [+], secunia [+], open source tools [+], chris eng [+], brandon creighton [+], application development platform [+], advisory [+], adobe [+], xml [+], vulnerable versions [+], txt [+], stephen [+], session fixation vulnerability [+], session [+], service vulnerability [+], server [+], security bulletins [+], read [+], pentesters [+], multiple [+], information disclosure vulnerability [+], hash collision [+], hash [+], g.r [+], fixation [+], file upload [+], fckeditor [+], external entity [+], exploits [+], exploitation activities [+], default locations [+], darknet [+], crlf [+], coldfusion server [+], coldfusion application server [+], coldfusion administrator [+], code [+], cfform [+], cf research [+], bsides [+], boston [+], asp jsp [+], administrator [+], administrative interface [+], access [+], ExploitsVulnerabilities [+], cross [+]

• April 23, 2012
• 5:00

  From LOW to PWNED [2] ColdFusion

   » ‎ Carnal0wnage
  
  Several (tm) months back I did my talk on "From LOW to PWNED" at hashdays and BSides Atlanta.
  
  The slides were published here and the video from hashdays is here, no video for BSides ATL.
  
  I consistently violate presentation zen and I try to make my slides usable after the talk but I decided to do a few blog posts covering the topics I put in the talk anyway.
  
  Post [2] ColdFusion
  
  Whhhhaaaat? ColdFusion?
  

  • Originally released in 1995 by Allaire
  • Motivation: make it easier to connect simple HTML pages to a database

  • Along the way became full Java
  • Latest version is ColdFusion 9 released in 2009
  • Most recent features focus on integration with other technologies, e.g. Flash, Flex, AIR, Exchange, MS Office, etc.
  • Frequent to see CF 7 - 9 on the web

  • Open Source CFML avalable as well
  • BlueDragon, Railo, Mura CMS

  Background Reading:
  http://carnal0wnage.attackresearch.com/2011/12/not-0wning-that-coldfusion-server-but.html
  http://averagesecurityguy.info/2011/12/09/owning-a-coldfusion-server/
  https://media.blackhat.com/bh-us-10/presentations/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-slides.pdf
  https://media.blackhat.com/bh-us-10/whitepapers/Eng_Creighton/BlackHat-USA-2010-Eng-Creighton-Deconstructing-ColdFusion-wp.pdf
  http://www.orkspace.net/secdocs/Conferences/EuSecWest/2006/ColdFusion%20Security.pdf
  
  LOW?
  
  
  Two nice bugs exist that I don't think vuln scanners commonly check for
  
  
  Locale traversal CVE: 2010-2861
  coldfusion_locale_traversal.rb
  
  great overview/walkthru here: http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/
  Vulnerable Versions:
  ColdFusion MX6 6.1 base patches
  ColdFusion MX7 7,0,0,91690 base patches
  ColdFusion MX8 8,0,1,195765 base patches
  ColdFusion MX8 8,0,1,195765 with Hotfix4
  ColdFusion 9?  Immunity reported yes, but Adobe fixed downloadable version of 9. so maaaaaaybe if old version of 9.
  
  *no patches exist for 6 & 7 so if you see CF6 or CF7 its always vuln to the bug*
  
  Adobe XML External Entity Injection: CVE-2009-3960
  adobe_xml_inject.rb
  
  advisory info here: http://www.security-assessment.com/files/advisories/2010-02-22_Multiple_Adobe_Products-XML_External_Entity_and_XML_Injection.pdf
  
  There's lots more to the ColdFusion story, enough that I recently gave a talk on it.

  Tags:  directory-traversal bsides vulnerable-versions coldfusion  

• April 11, 2012
• 11:10

  ColdFusion for Pentesters at SOURCE Boston

   » ‎ Carnal0wnage
  I'll be giving my ColdFusion for Pentesters talk at SOURCE Boston next week.
  
  Here is the info from the abstract:
  
  "ColdFusion is one of those technologies where organizations are either ColdFusion shops or they won't touch it on a bet. Similarly, I find that pentesters have either been exposed to it and have a few tricks to attack it or not. Aside from common web application issues, ColdFusion can also be attacked on the network level and many times used to obtain remote access on the host. This talk will cover what is ColdFusion, common ColdFusion issues, finding useful ColdFusion URLs, identifying specific ColdFusion version and components, and verifying if common vulnerabilities are present in the ColdFusion server you are targeting. If access to the ColdFusion administrative interface can be obtained, you can perform post exploitation activities that will typically yield you remote access to the operating system supporting the ColdFusion install."
  
  
  Like the other talks, i'll do the what it is, why you care (?), and some ways to go after it.  Hopefully useful/interesting.
  
  Hope to see people there.
  
  -CG
  
  

  Tags:  access pentesters coldfusion boston coldfusion-server exploitation-activities administrative-interface  

• March 13, 2012
• 0:00

  Vuln: Adobe ColdFusion Hash Collision Denial Of Service Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Adobe ColdFusion Hash Collision Denial Of Service Vulnerability

  Tags:  coldfusion adobe hash hash-collision service-vulnerability denial-of-service  

• December 15, 2011
• 0:07

  Secunia Security Advisory 47251

   » ‎ Packet Storm Security Advisories
  Secunia Security Advisory - Two vulnerabilities have been reported in Adobe ColdFusion, which can be exploited by malicious people to conduct cross-site scripting attacks.

  Tags:  advisory secunia security security-advisory coldfusion  

• December 13, 2011
• 4:20

  Not 0wning That ColdFusion Server but Helping...

   » ‎ Carnal0wnage
  Stephen, @averagesecguy, wrote a post on owning a ColdFusion server. its pretty good and he wrote some code to help things along.
  
  Code: https://github.com/averagesecurityguy/scripts
  
  I thought I'd add to the conversation with some stuff I found doing CF research. The code he wrote and the metasploit module works great if things are in their default locations. Of course, this will never be the case when you are on a PT and need to break into that mofro.
  
  Anyway, there is a misconfiguration that, when its present, can greatly help you exploit that locale traversal attack. Alot of time you can get the sha1.js and verify that the patch is not applied.
  
  
  Anyway, more than once I've gotten that far but the host was Linux and locating the password.properties file failed. You're essentially guessing blind. So what i discovered is that sometimes the componentlist.cfm [Site/CFIDE/componentutils/componentlist.cfm] file is available. It looks like this:
  
  
  Click on one of the components and you get full path to the installed component:
  
  Not the best example, because stuff is where we would expect it to be. This one is better:
  
  
  Now you know where to direct that directory traversal to get the proper file.
  
  Other reading:
  http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/

  Tags:  server code coldfusion stephen cf-research password-properties default-locations  

• November 15, 2011
• 19:49

  Adobe ColdFusion 9 Denial Of Service

   » ‎ Packet Storm Security Exploits
  Adobe ColdFusion 9 suffers from denial of service and path disclosure vulnerabilities.

  Tags:  coldfusion adobe denial denial-of-service disclosure  

• 19:49

  Adobe ColdFusion 9 Denial Of Service

   » ‎ Packet Storm Security Recent Files
  Adobe ColdFusion 9 suffers from denial of service and path disclosure vulnerabilities.

  Tags:  coldfusion adobe denial denial-of-service disclosure  

• 19:49

  Adobe ColdFusion 9 Denial Of Service

   » ‎ Packet Storm Security Misc. Files
  Adobe ColdFusion 9 suffers from denial of service and path disclosure vulnerabilities.

  Tags:  coldfusion adobe denial denial-of-service disclosure  

• September 27, 2011
• 0:00

  Vuln: Adobe ColdFusion Multiple Cross Site Scripting Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Adobe ColdFusion Multiple Cross Site Scripting Vulnerabilities

  Tags:  coldfusion adobe  

• September 26, 2011
• 17:55

  Adobe ColdFusion 7 Cross Site Scripting

   » ‎ Packet Storm Security Exploits
  Adobe ColdFusion versions 7 and below suffer from cross site scripting and path disclosure vulnerabilities.

  Tags:  cross coldfusion adobe cross-site-scripting disclosure  

• 17:55

  Adobe ColdFusion 7 Cross Site Scripting

   » ‎ Packet Storm Security Recent Files
  Adobe ColdFusion versions 7 and below suffer from cross site scripting and path disclosure vulnerabilities.

  Tags:  cross coldfusion adobe cross-site-scripting disclosure  

• 17:55

  Adobe ColdFusion 7 Cross Site Scripting

   » ‎ Packet Storm Security Misc. Files
  Adobe ColdFusion versions 7 and below suffer from cross site scripting and path disclosure vulnerabilities.

  Tags:  cross coldfusion adobe cross-site-scripting disclosure  

• September 14, 2011
• 15:45

  Top Seven ColdFusion Security Issues

   » ‎ Packet Storm Security Recent Files
  This whitepaper discusses the most prevalent security issues with server configurations and application implementations for ColdFusion.

  Tags:  coldfusion whitepaper security server-configurations security-issues  

• 15:45

  Top Seven ColdFusion Security Issues

   » ‎ Packet Storm Security Misc. Files
  This whitepaper discusses the most prevalent security issues with server configurations and application implementations for ColdFusion.

  Tags:  coldfusion whitepaper security server-configurations security-issues  

• September 12, 2011
• 13:05

  [Paper] Deconstructing ColdFusion

   » ‎ SecDocs
  Authors: Brandon Creighton Chris Eng
  Tags: ColdFusion
  Event: Black Hat USA 2010
  Abstract: ColdFusion is a somewhat forgotten but still very prevalent web application development platform. This presentation is a technical survey of ColdFusion security that will be of interest mostly to code auditors, penetration testers, and developers. In the talk, we’ll cover the history of the ColdFusion platform and its relevance to today’s security landscape. We’ll describe basics of ColdFusion markup, control flow, functions, and components and demonstrate how to identify common web application vulnerabilities in the source code. We’ll also delve into ColdFusion J2EE internals, showing what CFML pages and components look like when compiled down to Java, and describing some of the unusual behavior we’ve observed at that level. Included in the talk is a detailed description of the WAR/EAR structure for compiled ColdFusion apps. We'll release open-source tools to aid reverse engineers in working with ColdFusion's proprietary classfile format.

  Tags:  web coldfusion application chris-eng brandon-creighton usa application-development-platform open-source-tools web-application-development  

• September 09, 2011
• 5:52

  [Slides] Deconstructing ColdFusion

   » ‎ SecDocs
  Authors: Brandon Creighton Chris Eng
  Tags: ColdFusion
  Event: Black Hat USA 2010
  Abstract: ColdFusion is a somewhat forgotten but still very prevalent web application development platform. This presentation is a technical survey of ColdFusion security that will be of interest mostly to code auditors, penetration testers, and developers. In the talk, we’ll cover the history of the ColdFusion platform and its relevance to today’s security landscape. We’ll describe basics of ColdFusion markup, control flow, functions, and components and demonstrate how to identify common web application vulnerabilities in the source code. We’ll also delve into ColdFusion J2EE internals, showing what CFML pages and components look like when compiled down to Java, and describing some of the unusual behavior we’ve observed at that level. Included in the talk is a detailed description of the WAR/EAR structure for compiled ColdFusion apps. We'll release open-source tools to aid reverse engineers in working with ColdFusion's proprietary classfile format.

  Tags:  web coldfusion application chris-eng brandon-creighton usa application-development-platform open-source-tools web-application-development  

• August 18, 2011
• 20:27

  Secunia Security Advisory 45620

   » ‎ Packet Storm Security Advisories
  Secunia Security Advisory - G.R0b1n has discovered a vulnerability in Adobe ColdFusion, which can be exploited by malicious people to conduct cross-site scripting attacks.

  Tags:  advisory secunia security g.r security-advisory coldfusion  

• 18:10

  ColdFusion probe.cfm Cross Site Scripting

   » ‎ Packet Storm Security Exploits
  ColdFusion suffers from a cross site scripting vulnerability in probe.cfm.

  Tags:  probe cross coldfusion vulnerability  

• 18:10

  ColdFusion probe.cfm Cross Site Scripting

   » ‎ Packet Storm Security Recent Files
  ColdFusion suffers from a cross site scripting vulnerability in probe.cfm.

  Tags:  probe cross coldfusion vulnerability  

• 18:10

  ColdFusion probe.cfm Cross Site Scripting

   » ‎ Packet Storm Security Misc. Files
  ColdFusion suffers from a cross site scripting vulnerability in probe.cfm.

  Tags:  probe cross coldfusion vulnerability  

• March 16, 2011
• 15:00

  [remote exploits] - Adobe ColdFusion - Directory Traversal

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  [remote exploits] - Adobe ColdFusion - Directory Traversal

  Tags:  directory coldfusion adobe directory-traversal exploits  

• 14:11

  Adobe ColdFusion - Directory Traversal

   » ‎ Packet Storm Security Exploits
  This Metasploit module exploits a directory traversal bug in Adobe ColdFusion. By reading the password.properties a user can login using the encrypted password itself. This should work on version 8 and below.

  Tags:  directory coldfusion adobe password-properties encrypted-password directory-traversal  

• 14:11

  Adobe ColdFusion - Directory Traversal

   » ‎ Packet Storm Security Recent Files
  This Metasploit module exploits a directory traversal bug in Adobe ColdFusion. By reading the password.properties a user can login using the encrypted password itself. This should work on version 8 and below.

  Tags:  directory coldfusion adobe password-properties encrypted-password directory-traversal  

• 14:11

  Adobe ColdFusion - Directory Traversal

   » ‎ Packet Storm Security Misc. Files
  This Metasploit module exploits a directory traversal bug in Adobe ColdFusion. By reading the password.properties a user can login using the encrypted password itself. This should work on version 8 and below.

  Tags:  directory coldfusion adobe password-properties encrypted-password directory-traversal  

• March 15, 2011
• 19:23

  Adobe ColdFusion Cross Site Scripting

   » ‎ Packet Storm Security Exploits
  Adobe ColdFusion suffers from multiple cross site scripting and information disclosure vulnerabilities in the administration console.

  Tags:  cross coldfusion adobe information-disclosure vulnerabilities  

• 19:23

  Adobe ColdFusion Cross Site Scripting

   » ‎ Packet Storm Security Recent Files
  Adobe ColdFusion suffers from multiple cross site scripting and information disclosure vulnerabilities in the administration console.

  Tags:  cross coldfusion adobe information-disclosure vulnerabilities  

• 19:23

  Adobe ColdFusion Cross Site Scripting

   » ‎ Packet Storm Security Misc. Files
  Adobe ColdFusion suffers from multiple cross site scripting and information disclosure vulnerabilities in the administration console.

  Tags:  cross coldfusion adobe information-disclosure vulnerabilities  

• 0:00

  Vuln: Adobe ColdFusion (CVE-2011-0580) Multiple Cross Site Scripting Vulnerabilities

   » ‎ SecurityFocus Vulnerabilities
  Adobe ColdFusion (CVE-2011-0580) Multiple Cross Site Scripting Vulnerabilities

  Tags:  multiple coldfusion adobe cve  

• March 08, 2011
• 0:00

  Vuln: Adobe ColdFusion (CVE-2011-0584) Session Fixation Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Adobe ColdFusion (CVE-2011-0584) Session Fixation Vulnerability

  Tags:  coldfusion session adobe session-fixation-vulnerability cve fixation  

• 0:00

  Vuln: Adobe ColdFusion Administrator Console Information Disclosure Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Adobe ColdFusion Administrator Console Information Disclosure Vulnerability

  Tags:  coldfusion administrator adobe information-disclosure-vulnerability coldfusion-administrator  

• 0:00

  Vuln: Adobe ColdFusion 'cfform' Tag Cross Site Scripting Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Adobe ColdFusion 'cfform' Tag Cross Site Scripting Vulnerability

  Tags:  cfform coldfusion adobe cross-site-scripting  

• 0:00

  Vuln: Adobe ColdFusion (CVE-2011-0581) CRLF Injection Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Adobe ColdFusion (CVE-2011-0581) CRLF Injection Vulnerability

  Tags:  coldfusion crlf adobe cve vulnerability  

• January 28, 2011
• 5:44

  Adobe ColdFusion Cross Site Scripting / Disclosure

   » ‎ Packet Storm Security Exploits
  Adobe ColdFusion suffers from cross site scripting and disclosure vulnerabilities.

  Tags:  cross coldfusion adobe disclosure  

• 5:44

  Adobe ColdFusion Cross Site Scripting / Disclosure

   » ‎ Packet Storm Security Recent Files
  Adobe ColdFusion suffers from cross site scripting and disclosure vulnerabilities.

  Tags:  cross coldfusion adobe disclosure  

• 5:44

  Adobe ColdFusion Cross Site Scripting / Disclosure

   » ‎ Packet Storm Security Misc. Files
  Adobe ColdFusion suffers from cross site scripting and disclosure vulnerabilities.

  Tags:  cross coldfusion adobe disclosure  

• November 06, 2010
• 5:57

  Adobe XML Injection Metasploit Module

   » ‎ Carnal0wnage
  I just pushed out code coverage for the Adobe XML External Entity Injection vulnerability in multiple adobe products including: BlazeDS 3.2 and earlier versions, LiveCycle 9.0, 8.2.1, and
  8.0.1, LiveCycle Data Services 3.0, 2.6.1, and 2.5.1, Flex Data
  Services 2.0.1, ColdFusion 9.0, 8.0.1, 8.0, and 7.0.2
  
  References Here:
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-3960
  http://www.osvdb.org/62292
  http://www.securityfocus.com/bid/38197
  http://www.security-assessment.com/files/advisories/2010-02-22_Multiple_Adobe_Products-XML_External_Entity_and_XML_Injection.pdf
  http://www.adobe.com/support/security/bulletins/apsb10-05.html
  
  I recommend you read security-asessment's pdf on it, its good.
  
  Anyway, its a cool bug.
  1 -->because it affects several products although most people have probably never heard of most of them except for ColdFusion.
  2 -->its enabled by default on all those products you've never heard of except for ColdFusion, with the exception of CF 8 which appears to have it turned on by default.
  3 -->You have to apply patches for CF individually and there is no automated process. Since this vuln got little media attention I've seen alot of hosts that are still missing this patch and/or didn't turn off the vuln service.
  
  On with the demo!
  
  So against a patched host or someone that has disabled the service in ColdFusion you'll see one of two things; either 404's for the checks or 200 for /flex2gateway/ and 500 for the http or https check.
  
  
  
  If you get a bunch of 400's then you need to set the VHOST
  
  
  When it works, you'll see something like this for /etc/passwd
  
  
  and like this when you asked for a file that doesn't exist or doesn't have permission to read (since CF doesn't run as root on linux, requesting /etc/shadow wont work) :-(
  
  
  At this point, you're probably like "so what" well whats cool about arbitrary file read is that 1. it also works on Windows:
  
  and 2. that whole password.properties attack is now cool again because you can just request that file too
  
  
  -CG

  Tags:  xml coldfusion adobe password-properties security-bulletins external-entity  

• November 02, 2010
• 20:01

  coldfusion_fckeditor.rb.txt

   » ‎ Packet Storm Security Exploits
  This Metasploit module exploits the Adobe ColdFusion 8.0.1 FCKeditor 'CurrentFolder' File Upload and Execute vulnerability.

  Tags:  txt fckeditor coldfusion file-upload vulnerability  

• August 19, 2010
• 0:00

  Vuln: Adobe ColdFusion CVE-2010-2861 Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Adobe ColdFusion CVE-2010-2861 Directory Traversal Vulnerability

  Tags:  directory coldfusion adobe directory-traversal-vulnerability cve  

• August 17, 2010
• 2:39

  Serious Vulnerability In Adobe ColdFusion Application Server

   » ‎ Darknet
  We haven’t often reported anything relating to ColdFusion, the application server from Adobe, most likely because it’s not a very prevalent hosting platform. It was quite popular earlier in the decade before PHP became so popular, the choices back then were early versions of ASP, JSP and CFM. We’ve only posted one tool related to...
  
  Read the full post at darknet.org.uk

  
  

  

  Tags:  coldfusion application adobe read coldfusion-application-server asp-jsp darknet ExploitsVulnerabilities  

• August 14, 2010
• 4:06

  Adobe ColdFusion Directory Traversal Vulnerability

   » ‎ 1337day (was: Inj3ct0r, 1337db)
  Adobe ColdFusion Directory Traversal Vulnerability

  Tags:  directory coldfusion adobe directory-traversal-vulnerability  

• August 13, 2010
• 0:00

  Vuln: Adobe ColdFusion CVE-2010-2861 Unspecified Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Adobe ColdFusion CVE-2010-2861 Unspecified Directory Traversal Vulnerability

  Tags:  coldfusion unspecified adobe directory-traversal-vulnerability cve  

• August 11, 2010
• 0:00

  Vuln: Adobe ColdFusion CVE-2010-2861 Unspecified Directory Traversal Vulnerability

   » ‎ SecurityFocus Vulnerabilities
  Adobe ColdFusion CVE-2010-2861 Unspecified Directory Traversal Vulnerability

  Tags:  coldfusion unspecified adobe directory-traversal-vulnerability cve