Comments on: ColdFusion directory traversal FAQ (CVE-2010-2861) http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/ Information Security Think Tank Sat, 02 Feb 2013 17:50:40 +0000 hourly 1 http://wordpress.org/?v=3.4.1 By: Zoi http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-134108 Zoi Thu, 25 Oct 2012 17:19:01 +0000 https://www.gnucitizen.org/?p=3665#comment-134108 I tested this out it doesnt seem to work. I obtained the hash of a ColdFusion 7 system. However passing the hash does not work. I tried several times really fast the whole process. you have some video demonstrating this? I tested this out it doesnt seem to work. I obtained the hash of a ColdFusion 7 system. However passing the hash does not work. I tried several times really fast the whole process. you have some video demonstrating this?

]]> By: Shubham http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-134092 Shubham Tue, 04 Sep 2012 12:31:29 +0000 https://www.gnucitizen.org/?p=3665#comment-134092 Feel free to look at my automation of this process at http://code.google.com/p/cfide-autopwn/. Currently it supports lists, and can rip hashes via enter.cfm method. Sooner it will support the uploading of a web shell. Great if you want to mass check your servers. Feel free to look at my automation of this process at http://code.google.com/p/cfide-autopwn/. Currently it supports lists, and can rip hashes via enter.cfm method. Sooner it will support the uploading of a web shell. Great if you want to mass check your servers.

]]> By: mr,prince http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-134021 mr,prince Mon, 02 Apr 2012 12:35:27 +0000 https://www.gnucitizen.org/?p=3665#comment-134021 pagvac:) The attacker does not need to crack the sha1? yes and NO? pagvac:) The attacker does not need to crack the sha1? yes and NO?

]]> By: anagogue http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-129554 anagogue Fri, 14 Jan 2011 16:34:28 +0000 https://www.gnucitizen.org/?p=3665#comment-129554 Any hints on what to do with a ColdFusionMX password? Didn't that use a weaker hash/encryption function than 7/8+? I assume it should be fairly easily crackable, but need a hint on what to use on it. Any hints on what to do with a ColdFusionMX password? Didn’t that use a weaker hash/encryption function than 7/8+?

I assume it should be fairly easily crackable, but need a hint on what to use on it.

]]> By: Ashok http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-128844 Ashok Wed, 01 Sep 2010 23:23:18 +0000 https://www.gnucitizen.org/?p=3665#comment-128844 Hi ! Thanks for the article ..... I found something wired with Gmail password. For long time I have been using a password with space at the beginning and end of the alphanumerical characters. e.g- ” passwd ” But actually Gmail doesn’t count if there is spaces at the beginning and end of the password. Basically you could use the space character as much as you like at the beginning and end with actual password, still you can sign in. I couldn’t find any article related to this … But I could exploit this feature(!) at times when some one try to count the number of characters in the password, by adding some spaces. Hi ! Thanks for the article ….. I found something wired with Gmail password. For long time I have been using a password with space at the beginning and end of the alphanumerical characters.

e.g- ” passwd ” But actually Gmail doesn’t count if there is spaces at the beginning and end of the password. Basically you could use the space character as much as you like at the beginning and end with actual password, still you can sign in. I couldn’t find any article related to this … But I could exploit this feature(!) at times when some one try to count the number of characters in the password, by adding some spaces.

]]> By: pagvac http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-128741 pagvac Tue, 24 Aug 2010 16:11:36 +0000 https://www.gnucitizen.org/?p=3665#comment-128741 @Simon: the value of the 'salt' parameter expires after a few seconds on the server side (60 seconds IIRC). This means you need perform the steps mentioned in this post within this time window. Why wouldn't it work? Think about it, the login form simply hashes the password entered by the user with the value of the 'salt' parameter as returned by the application within client-side JS code. You can replicate all these steps yourself without needing to know the plaintext password. @Simon: the value of the ‘salt’ parameter expires after a few seconds on the server side (60 seconds IIRC). This means you need perform the steps mentioned in this post within this time window.

Why wouldn’t it work? Think about it, the login form simply hashes the password entered by the user with the value of the ‘salt’ parameter as returned by the application within client-side JS code. You can replicate all these steps yourself without needing to know the plaintext password.

]]> By: BlueThunder Blog » ColdFusion Directory Traversal vulnerability http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-128734 BlueThunder Blog » ColdFusion Directory Traversal vulnerability Mon, 23 Aug 2010 23:48:11 +0000 https://www.gnucitizen.org/?p=3665#comment-128734 [...] allowing the inclusion of other files from the same disk the CFAdmin section is living on.  As Adrian Pastor points out, CF runs under the SYSTEM account by default, which means access to any file on the drive.  [...] [...] allowing the inclusion of other files from the same disk the CFAdmin section is living on.  As Adrian Pastor points out, CF runs under the SYSTEM account by default, which means access to any file on the drive.  [...]

]]> By: Simon http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-128722 Simon Thu, 19 Aug 2010 14:29:26 +0000 https://www.gnucitizen.org/?p=3665#comment-128722 I tested this out with my client and it doesnt seem to work. I obtained the hash of a ColdFusion 8 and 7 system. However passing the hash does not work. I think you must crack it. I tested this out with my client and it doesnt seem to work. I obtained the hash of a ColdFusion 8 and 7 system. However passing the hash does not work. I think you must crack it.

]]> By: pagvac http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-128721 pagvac Wed, 18 Aug 2010 17:05:16 +0000 https://www.gnucitizen.org/?p=3665#comment-128721 Lucas: there are many ways to do this, blocking the URL with a WAF is one of them. Also, you can do it on the web server itself. For instance, on Apache you could add the following to the config file: <pre><code><Location /CFIDE> Order Deny,Allow Deny from all Allow from 127.0.0.1 </Location></code></pre> Just make sure you test the new configuration settings thoroughly before placing the server into production. For instance, some non-admin features rely on access to /CFIDE/ . E.g.: charts (cfchart) requires access to /CFIDE/GraphData.cfm. Take a look at the ColdFusion lockdown guide for more info: http://www.adobe.com/products/coldfusion/whitepapers/pdf/91025512_cf9_lockdownguide_wp_ue.pdf Lucas: there are many ways to do this, blocking the URL with a WAF is one of them. Also, you can do it on the web server itself. For instance, on Apache you could add the following to the config file:

<Location /CFIDE>
Order Deny,Allow
Deny from all
Allow from 127.0.0.1
</Location>

Just make sure you test the new configuration settings thoroughly before placing the server into production. For instance, some non-admin features rely on access to /CFIDE/ . E.g.: charts (cfchart) requires access to /CFIDE/GraphData.cfm. Take a look at the ColdFusion lockdown guide for more info: http://www.adobe.com/products/....._wp_ue.pdf

]]> By: Lek in ColdFusion kaapt webservers » QTA Nieuws http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-128720 Lek in ColdFusion kaapt webservers » QTA Nieuws Wed, 18 Aug 2010 14:16:32 +0000 https://www.gnucitizen.org/?p=3665#comment-128720 [...] daarmee de analyse van hacker Adrian Pastor die vrijdag al stelde dat het ColdFusion-lek kritiek is en niet slechts 'belangrijk'. Exploitcode voor dit lek is inmiddels publiekelijk beschikbaar. Adobe heeft maandag nog een [...] [...] daarmee de analyse van hacker Adrian Pastor die vrijdag al stelde dat het ColdFusion-lek kritiek is en niet slechts 'belangrijk'. Exploitcode voor dit lek is inmiddels publiekelijk beschikbaar. Adobe heeft maandag nog een [...]

]]> By: Vulnerabilidad en Cold Fusion de Adobe mas critica de lo que se cree | OpenSecurity http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-128713 Vulnerabilidad en Cold Fusion de Adobe mas critica de lo que se cree | OpenSecurity Tue, 17 Aug 2010 15:28:32 +0000 https://www.gnucitizen.org/?p=3665#comment-128713 [...] usuarios deberían instalar una actualización de seguridad. Existe más información en el Blog GnuCitizen con más detalles sobre esta [...] [...] usuarios deberían instalar una actualización de seguridad. Existe más información en el Blog GnuCitizen con más detalles sobre esta [...]

]]> By: pagvac http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-128712 pagvac Tue, 17 Aug 2010 14:07:15 +0000 https://www.gnucitizen.org/?p=3665#comment-128712 Jones: once you upload the cfm backdoor, you should be able to delete any files (SYSTEM privs by default), including the backdoor itself. After all, you can run arbitrary commands. E.g. <code>del \ColdFusion8\wwwroot\cfexec.cfm</code> Jones: once you upload the cfm backdoor, you should be able to delete any files (SYSTEM privs by default), including the backdoor itself. After all, you can run arbitrary commands. E.g. del \ColdFusion8\wwwroot\cfexec.cfm

]]> By: ColdFusion vulnerability more critical than first thought http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-128711 ColdFusion vulnerability more critical than first thought Tue, 17 Aug 2010 11:50:56 +0000 https://www.gnucitizen.org/?p=3665#comment-128711 [...] highest priority to installing the security update. A FAQ page on security blog GnuCitizen provides further information on workarounds. Source: [...] [...] highest priority to installing the security update. A FAQ page on security blog GnuCitizen provides further information on workarounds. Source: [...]

]]> By: Lucas http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-128710 Lucas Tue, 17 Aug 2010 10:30:49 +0000 https://www.gnucitizen.org/?p=3665#comment-128710 Hi, just wonder why can't I just block entire CFIDE folder to anyone except one IP? Can that screw something? Cheers! Hi, just wonder why can’t I just block entire CFIDE folder to anyone except one IP? Can that screw something? Cheers!

]]> By: Jones http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-128708 Jones Tue, 17 Aug 2010 07:11:31 +0000 https://www.gnucitizen.org/?p=3665#comment-128708 How would you delete a uploaded file to a exploited server? Im currently testing this in my lab at home. but i cant seem to figure out how to delete all uploaded scripts. How would you delete a uploaded file to a exploited server? Im currently testing this in my lab at home. but i cant seem to figure out how to delete all uploaded scripts.

]]> By: Adobe ColdFusion’s Directory Traversal Disaster « ColdFusion Developers Network http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-128707 Adobe ColdFusion’s Directory Traversal Disaster « ColdFusion Developers Network Mon, 16 Aug 2010 13:04:07 +0000 https://www.gnucitizen.org/?p=3665#comment-128707 [...] why I think this is a big mistake … on top of the excellent analysis Adrian has already done (check his excellent post here) I think it’s relevent to do a little digging yourself to understand the full scope of the [...] [...] why I think this is a big mistake … on top of the excellent analysis Adrian has already done (check his excellent post here) I think it’s relevent to do a little digging yourself to understand the full scope of the [...]

]]> By: pagvac http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-128705 pagvac Sun, 15 Aug 2010 21:34:19 +0000 https://www.gnucitizen.org/?p=3665#comment-128705 @Niels: didn't think of that TBH. Excellent point! I haven't tested it but should definitely work. This would make cracking the SHA1 hash totally unnecessary! @sunjester: ;D @Niels: didn’t think of that TBH. Excellent point! I haven’t tested it but should definitely work. This would make cracking the SHA1 hash totally unnecessary!

@sunjester: ;D

]]> By: Niels Teusink http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-128703 Niels Teusink Sat, 14 Aug 2010 16:49:47 +0000 https://www.gnucitizen.org/?p=3665#comment-128703 Thanks for the article Adrian! I have one addition: An attacker does not need to crack the SHA1-hash. The CF8 login screen does this: <code>onSubmit="cfadminPassword.value = hex_hmac_sha1(salt.value, hex_sha1(cfadminPassword.value));"</code> This allows attackers to authenticate using the hash instead of cracking it. Thanks for the article Adrian! I have one addition: An attacker does not need to crack the SHA1-hash. The CF8 login screen does this: onSubmit="cfadminPassword.value = hex_hmac_sha1(salt.value, hex_sha1(cfadminPassword.value));"

This allows attackers to authenticate using the hash instead of cracking it.

]]> By: sunjester http://www.gnucitizen.org/blog/coldfusion-directory-traversal-faq-cve-2010-2861/comment-page-1/#comment-128702 sunjester Sat, 14 Aug 2010 06:35:53 +0000 https://www.gnucitizen.org/?p=3665#comment-128702 Maybe Adobe hires new guys.. lol Maybe Adobe hires new guys.. lol

]]>