跳转至

Adobe ColdFusion 远程代码执行漏洞（CVE-2021-21087）

Adobe ColdFusion是一个快速应用程序开发平台。。Adobe ColdFusion 存在远程代码执行漏洞，由于过滤不严，未经授权的攻击者可构造恶意请求，造成任意代码执行，控制服务器。建议相关用户尽快采取安全措施阻止漏洞攻击。

影响范围

  • Adobe ColdFusion 2021 <= Version 2021.0.0.323925
  • Adobe ColdFusion 2018 <= Update 10
  • Adobe ColdFusion 2016 <= Update 16

FOFA：

app="Adobe-ColdFusion"

PoC：

  - method: GET
    path:
      - "{{BaseURL}}/cf_scripts/scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/cf-scripts/scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/CFIDE/scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/cfide/scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/CF_SFSD/scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/cfide-scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/cfmx/CFIDE/scripts/ajax/package/cfajax.js"

regex:
          - 'eval\(\"\(\"\+json\+\"\)\"\)'

ref：

  • https://nosec.org/home/detail/4707.html
  • https://github.com/projectdiscovery/nuclei-templates/pull/1128/files
  • https://helpx.adobe.com/security/products/coldfusion/apsb21-16.html