CVE-2021-21307

🗓️ 11 Feb 2021 18:20:21Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 246 Views🌐 WEB

Lucee Server unauthenticated remote code exploit fix in versions 5.3.7.47, 5.3.6.68, or 5.3.5.9

Reporter	Title	Published	Views	Family All 16
0day.today	Lucee Administrator imgProcess.cfm Arbitrary File Write Exploit	18 Aug 202100:00	–	zdt
ATTACKERKB	CVE-2021-21307	11 Feb 202100:00	–	attackerkb
Circl	CVE-2021-21307	11 Feb 202122:54	–	circl
CNNVD	Lucee Server Authorization Issues Vulnerability	11 Feb 202100:00	–	cnnvd
Cvelist	CVE-2021-21307 Remote Code Exploit in Lucee Admin	11 Feb 202118:20	–	cvelist
Metasploit	Lucee Administrator imgProcess.cfm Arbitrary File Write	17 Aug 202117:42	–	metasploit
Nuclei	Lucee Admin - Remote Code Execution	2 Jun 202610:14	–	nuclei
NVD	CVE-2021-21307	11 Feb 202119:15	–	nvd
OpenVAS	Lucee < 5.3.5.96, 5.3.6.x < 5.3.6.68, 5.3.7.x < 5.3.7.47 RCE Vulnerability (GHSA-2xvv-723c-8p7r) - Version Check	11 Jun 202100:00	–	openvas
OpenVAS	Lucee < 5.3.5.96, 5.3.6.x < 5.3.6.68, 5.3.7.x < 5.3.7.47 RCE Vulnerability (GHSA-2xvv-723c-8p7r) - Active Check	11 Jun 202100:00	–	openvas

NVD

Vulners

Node

lucee lucee_serverRange5.3.5.00–5.3.5.96

lucee lucee_serverRange5.3.6.00–5.3.6.68

lucee lucee_serverRange5.3.7.00–5.3.7.47

[
  {
    "product": "Lucee",
    "vendor": "lucee",
    "versions": [
      {
        "status": "affected",
        "version": ">= 5.3.5.0, < 5.3.5.96"
      },
      {
        "status": "affected",
        "version": ">= 5.3.6.0, < 5.3.6.68"
      },
      {
        "status": "affected",
        "version": ">= 5.3.7.0, < 5.3.7.47"
      }
    ]
  }
]

Source	Link
github	www.github.com/httpvoid/writeups/blob/main/Apple-RCE.md
dev	www.dev.lucee.org/t/lucee-vulnerability-alert-november-2020/7643
github	www.github.com/lucee/Lucee/commit/6208ab7c44c61d26c79e0b0af10382899f57e1ca
portswigger	www.portswigger.net/daily-swig/security-researchers-earn-50k-after-exposing-critical-flaw-in-apple-travel-portal
packetstormsecurity	www.packetstormsecurity.com/files/163864/Lucee-Administrator-imgProcess.cfm-Arbitrary-File-Write.html
ciacfug	www.ciacfug.org/blog/updating-lucee-as-part-of-a-vulnerability-alert-response
github	www.github.com/lucee/Lucee/security/advisories/GHSA-2xvv-723c-8p7r

Parameter	Position	Path	Description	CWE
file	query param	/lucee/admin/imgProcess.cfm	Path traversal risk to write files on the server via the imgProcess.cfm endpoint	CWE-862
imgSrc	query param	/lucee/admin/imgProcess.cfm	Path traversal risk to write files on the server via the imgProcess.cfm endpoint	CWE-862
dataDir	query param	/lucee/admin/admin.search.index.cfm	Copy/list/exploit logic via dataDir and LUCEEARCHIVEZIPPATH enabling file placement/execution	CWE-862
LUCEEARCHIVEZIPPATH	query param	/lucee/admin/admin.search.index.cfm	Copy/list/exploit logic via dataDir and LUCEEARCHIVEZIPPATH enabling file placement/execution	CWE-862
extfile	request body	/lucee/admin/ext.applications.upload.cfm	Unauthenticated extension upload (lex) leading to arbitrary file execution	CWE-862
dataDir	query param	/lucee/admin/admin.search.index.cfm	Zip-based payload delivery through dataDir/luceeArchiveZipPath enabling RCE	CWE-862
luceeArchiveZipPath	query param	/lucee/admin/admin.search.index.cfm	Zip-based payload delivery through dataDir/luceeArchiveZipPath enabling RCE	CWE-862
f	query param	/lucee/rootxharsh/searchindex.cfm	Webshell deployment via searchindex.cfm controlled by filename/content	CWE-862
content	query param	/lucee/rootxharsh/searchindex.cfm	Webshell deployment via searchindex.cfm controlled by filename/content	CWE-862

21 Nov 2024 05:47Current

9High risk

Vulners AI Score9

CVSS 27.5

CVSS 3.18.6 - 9.8

EPSS0.92058