Vulnerabilities > CVE-2013-0632 - Incorrect Default Permissions vulnerability in Adobe Coldfusion

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
adobe
CWE-276
critical
nessus
exploit available
metasploit

Summary

administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.

Vulnerable Configurations

Part Description Count
Application
Adobe
4

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Accessing Functionality Not Properly Constrained by ACLs
    In applications, particularly web applications, access to functionality is mitigated by the authorization framework, whose job it is to map ACLs to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application or can run queries for data that he is otherwise not supposed to.
  • Directory Indexing
    An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
  • Footprinting
    An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
  • Embedding Scripts within Scripts
    An attack of this type exploits a programs' vulnerabilities that are brought on by allowing remote hosts to execute scripts. The attacker leverages this capability to execute scripts to execute his/her own script by embedding it within other scripts that the target software is likely to execute. The attacker must have the ability to inject script into script that is likely to be executed. If this is done, then the attacker can potentially launch a variety of probes and attacks against the web server's local environment, in many cases the so-called DMZ, back end resources the web server can communicate with, and other hosts. With the proliferation of intermediaries, such as Web App Firewalls, network devices, and even printers having JVMs and Web servers, there are many locales where an attacker can inject malicious scripts. Since this attack pattern defines scripts within scripts, there are likely privileges to execute said attack on the host. Of course, these attacks are not solely limited to the server side, client side scripts like Ajax and client side JavaScript can contain malicious scripts as well. In general all that is required is for there to be sufficient privileges to execute a script, but not protected against writing.
  • Web Logs Tampering
    Web Logs Tampering attacks involve an attacker injecting, deleting or otherwise tampering with the contents of web logs typically for the purposes of masking other malicious behavior. Additionally, writing malicious data to log files may target jobs, filters, reports, and other agents that process the logs in an asynchronous attack pattern. This pattern of attack is similar to "Log Injection-Tampering-Forging" except that in this case, the attack is targeting the logs of the web server and not the application.

Exploit-Db

  • descriptionAdobe ColdFusion APSB13-03 - Remote Exploit. CVE-2013-0625,CVE-2013-0629,CVE-2013-0632. Remote exploits for multiple platform
    idEDB-ID:24946
    last seen2016-02-03
    modified2013-04-10
    published2013-04-10
    reportermetasploit
    sourcehttps://www.exploit-db.com/download/24946/
    titleAdobe ColdFusion APSB13-03 - Remote Exploit
  • descriptionAdobe ColdFusion 9 - Administrative Login Bypass. CVE-2013-0632. Webapps exploit for windows platform
    idEDB-ID:27755
    last seen2016-02-03
    modified2013-08-21
    published2013-08-21
    reporterScott Buckel
    sourcehttps://www.exploit-db.com/download/27755/
    titleAdobe ColdFusion 9 - Administrative Login Bypass
  • descriptionAdobe ColdFusion 9 - Administrative Login Bypass. CVE-2013-0632. Remote exploits for multiple platform
    fileexploits/multiple/remote/30210.rb
    idEDB-ID:30210
    last seen2016-02-03
    modified2013-12-11
    platformmultiple
    port80
    published2013-12-11
    reportermetasploit
    sourcehttps://www.exploit-db.com/download/30210/
    titleAdobe ColdFusion 9 - Administrative Login Bypass
    typeremote

Metasploit

Nessus

  • NASL familyCGI abuses
    NASL idCOLDFUSION_APSB13-03_AUTH_BYPASS.NASL
    descriptionThe version of Adobe ColdFusion running on the remote host is affected by an authentication bypass vulnerability. When RDS is disabled and not configured with password protection, it is possible to authenticate as an administrative user without providing a username or password. A remote, unauthenticated attacker can exploit this to gain administrative access to the ColdFusion Administrator interface. After authenticating, it is possible to write arbitrary files to the host, resulting in arbitrary code execution. This vulnerability is being exploited in the wild. This version of ColdFusion is reportedly affected by several additional vulnerabilities; however, Nessus has not checked for those issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id64689
    published2013-02-19
    reporterThis script is Copyright (C) 2013-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/64689
    titleAdobe ColdFusion Authentication Bypass (APSB13-03)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(64689);
      script_version("1.18");
      script_cvs_date("Date: 2018/11/15 20:50:16");
    
      script_cve_id("CVE-2013-0632");
      script_bugtraq_id(57330);
      script_xref(name:"EDB-ID", value:"24946");
      script_xref(name:"EDB-ID", value:"27755");
      script_xref(name:"EDB-ID", value:"30210");
    
      script_name(english:"Adobe ColdFusion Authentication Bypass (APSB13-03)");
      script_summary(english:"Bypasses authentication.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A web management interface running on the remote host is affected by
    an authentication bypass vulnerability.");
      script_set_attribute(attribute:"description", value:
    "The version of Adobe ColdFusion running on the remote host is affected
    by an authentication bypass vulnerability. When RDS is disabled and
    not configured with password protection, it is possible to
    authenticate as an administrative user without providing a username or
    password. A remote, unauthenticated attacker can exploit this to gain
    administrative access to the ColdFusion Administrator interface. After
    authenticating, it is possible to write arbitrary files to the host,
    resulting in arbitrary code execution. This vulnerability is being
    exploited in the wild.
    
    This version of ColdFusion is reportedly affected by several
    additional vulnerabilities; however, Nessus has not checked for those
    issues.");
      script_set_attribute(attribute:"see_also", value:"https://forums.adobe.com/message/4962104");
      # http://www.carehart.org/blog/client/index.cfm/2013/1/2/Part2_serious_security_threat
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?832b0298");
      script_set_attribute(attribute:"see_also", value:"https://www.adobe.com/support/security/advisories/apsa13-01.html");
      script_set_attribute(attribute:"see_also", value:"https://www.adobe.com/support/security/bulletins/apsb13-03.html");
      # https://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix-apsb13-03.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a76b1a91");
      script_set_attribute(attribute:"solution", value:
    "Apply the appropriate hotfix referenced in Adobe security bulletin
    APSB13-03.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Adobe ColdFusion 9 Administrative Login Bypass');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/12/28");  # forum post
      script_set_attribute(attribute:"patch_publication_date", value:"2013/01/15"); # APSB13-03
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/02/19");
    
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:coldfusion");
      script_set_attribute(attribute:"exploited_by_nessus", value:"true");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"CGI abuses");
    
      script_copyright(english:"This script is Copyright (C) 2013-2018 Tenable Network Security, Inc.");
    
      script_dependencies("coldfusion_detect.nasl", "coldfusion_rds_detect.nasl");
      script_require_keys("installed_sw/ColdFusion");
      script_require_ports("Services/www", 80, 8500);
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("http.inc");
    include("misc_func.inc");
    include("install_func.inc");
    
    app = 'ColdFusion';
    get_install_count(app_name:app, exit_if_zero:TRUE);
    
    port = get_http_port(default:80);
    
    install = get_single_install(
      app_name : app,
      port     : port
    );
    dir = install['path'];
    install_url = build_url(port:port, qs:dir);
    
    # In ColdFusion 9.x, the vulnerability exists if RDS is disabled.
    # In CF 10 it's present if RDS is disabled _and_ configured to not require
    # authentication. In the name of avoiding false positives and negatives,
    # this plugin will only bail out if RDS is enabled and authentication
    # is not required, an issue which is already reported by a different
    # plugin (coldfusion_rds_unauthenticated.nasl)
    rds_enabled = get_kb_item('coldfusion/' + port + '/rds/enabled');
    if (rds_enabled)
      exit(0, "RDS is enabled on the " +app+ " install at " + install_url);
    
    # first, get a session ID as the admin user
    auth_url = '/adminapi/administrator.cfc?method=login&adminpassword=&rdsPasswordAllowed=true';
    res = http_send_recv3(method:'GET', item:dir+auth_url, port:port, exit_on_fail:TRUE);
    
    # success: <wddxPacket version='1.0'><header/><data><boolean value='true'/></data></wddxPacket>
    # failure: <wddxPacket version='1.0'><header/><data><boolean value='false'/></data></wddxPacket>
    # if the server doesn't explicitly say the login failed, keep going just in case it worked and
    # an unexpected response was received
    if ('false' >< res[2])
      audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_url);
    
    # request a page that requires authentication, in order to verify the auth bypass worked
    about_url = '/administrator/aboutcf.cfm';
    res = http_send_recv3(method:'GET', item:dir+about_url, port:port, exit_on_fail:TRUE);
    
    if (
      'About ColdFusion Administrator' >!< res[2] &&
      res[2] !~ 'Version: *(<[^>+>)([0-9,.]+)'
    )
    {
      audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_url);
    }
    
    if (report_verbosity > 0)
    {
      report =
        '\nNessus was able to login without authenticating by requesting :\n\n' +
        install_url + auth_url + '\n' +
        '\nThe login was verified by requesting the following page, which' +
        '\nrequires authentication :\n\n' +
        install_url + about_url + '\n';
      security_hole(port:port, extra:report);
    }
    else security_hole(port);
    
  • NASL familyWindows
    NASL idCOLDFUSION_WIN_APSB13-03.NASL
    descriptionThe version of Adobe ColdFusion running on the remote host is missing hotfixes that address the following vulnerabilities : - An authentication bypass vulnerability exists that could allow an unauthorized user to gain administrative access. (CVE-2013-0625) - A directory traversal vulnerability exists that could allow an unauthorized user to gain administrative access. (CVE-2013-0629) - An unspecified information disclosure vulnerability exists that affects servers that have already been compromised. (CVE-2013-0631) - Authentication bypass vulnerability exists that could allow an unauthorized user to gain administrative access. (CVE-2013-0632)
    last seen2020-06-01
    modified2020-06-02
    plugin id66526
    published2013-05-21
    reporterThis script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/66526
    titleAdobe ColdFusion Multiple Vulnerabilities (APSB13-03) (credentialed check)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(66526);
      script_version("1.10");
      script_cvs_date("Date: 2019/11/27");
    
      script_cve_id(
        "CVE-2013-0625",
        "CVE-2013-0629",
        "CVE-2013-0631",
        "CVE-2013-0632"
      );
      script_bugtraq_id(
        57164,
        57165,
        57166,
        57330
      );
      script_xref(name:"EDB-ID", value:"24946");
      script_xref(name:"EDB-ID", value:"27755");
    
      script_name(english:"Adobe ColdFusion Multiple Vulnerabilities (APSB13-03) (credentialed check)");
      script_summary(english:"Checks for hotfixes");
    
      script_set_attribute(attribute:"synopsis", value:
    "A web-based application running on the remote Windows host is affected
    by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of Adobe ColdFusion running on the remote host is missing
    hotfixes that address the following vulnerabilities :
    
      - An authentication bypass vulnerability exists that could
        allow an unauthorized user to gain administrative
        access. (CVE-2013-0625)
    
      - A directory traversal vulnerability exists that could
        allow an unauthorized user to gain administrative
        access. (CVE-2013-0629)
    
      - An unspecified information disclosure vulnerability
        exists that affects servers that have already been
        compromised. (CVE-2013-0631)
    
      - Authentication bypass vulnerability exists that could
        allow an unauthorized user to gain administrative
        access. (CVE-2013-0632)");
      script_set_attribute(attribute:"see_also", value:"https://forums.adobe.com/message/4962104");
      # http://www.carehart.org/blog/client/index.cfm/2013/1/2/Part2_serious_security_threat
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?832b0298");
      script_set_attribute(attribute:"see_also", value:"https://www.adobe.com/support/security/advisories/apsa13-01.html");
      script_set_attribute(attribute:"see_also", value:"https://www.adobe.com/support/security/bulletins/apsb13-03.html");
      # https://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix-apsb13-03.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a76b1a91");
      script_set_attribute(attribute:"solution", value:
    "Apply the appropriate hotfixes referenced in Adobe security bulletin
    APSB13-03.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2013-0632");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploit_framework_core", value:"true");
      script_set_attribute(attribute:"metasploit_name", value:'Adobe ColdFusion 9 Administrative Login Bypass');
      script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2012/12/28");
      script_set_attribute(attribute:"patch_publication_date", value:"2013/01/15");
      script_set_attribute(attribute:"plugin_publication_date", value:"2013/05/21");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:coldfusion");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("coldfusion_win_local_detect.nasl");
      script_require_keys("SMB/coldfusion/instance");
      script_require_ports(139, 445);
    
      exit(0);
    }
    
    include("audit.inc");
    include("coldfusion_win.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    include("smb_func.inc");
    
    versions = make_list('9.0.0', '9.0.1', '9.0.2', '10.0.0');
    instances = get_coldfusion_instances(versions); # this exits if it fails
    
    # Check the hotfixes and cumulative hotfixes installed for each
    # instance of ColdFusion.
    info = NULL;
    instance_info = make_list();
    
    # a connection needs to be made to the system in order to call check_cfide_hotfix()
    port   = kb_smb_transport();
    login  = kb_smb_login();
    pass   = kb_smb_password();
    domain = kb_smb_domain();
    
    if(! smb_session_init()) audit(AUDIT_FN_FAIL, 'smb_session_init');
    
    cfide_file = "\CFIDE\adminapi\administrator.cfc";
    searchterm = 'isRdsEnabled';
    
    foreach name (keys(instances))
    {
      info = NULL;
      ver = instances[name];
    
      if (ver == "9.0.0")
      {
        info = check_cfide_hotfix(name, cfide_file, searchterm, 'CFIDE-9.zip');
        remove = make_list("00001", "00002", "00003", "00004", "00005", "00006", "00007", "00008");
        info += check_jar_hotfix(name, "00009", 2, remove);
      }
      else if (ver == "9.0.1")
      {
        info = check_cfide_hotfix(name, cfide_file, searchterm, 'CFIDE-901.zip');
        remove = make_list("00001", "00002", "00003", "00004", "00005", "00006", "00007");
        info += check_jar_hotfix(name, "00008", 3, remove);
      }
      else if (ver == "9.0.2")
      {
        info = check_cfide_hotfix(name, cfide_file, searchterm, 'CFIDE-902.zip');
        remove = make_list("00001", "00002");
        info += check_jar_hotfix(name, "00003", 1, remove);
      }
      else if (ver == "10.0.0")
      {
        # CF10 uses an installer for updates so it is less likely (perhaps not possible) to only partially install a hotfix.
        # this means the plugin doesn't need to check for anything in the CFIDE directory, it just needs to check the CHF level
        info = check_jar_chf(name, 7);
      }
    
      if (!isnull(info))
        instance_info = make_list(instance_info, info);
    }
    
    NetUseDel();
    
    if (max_index(instance_info) == 0)
      exit(0, "No vulnerable instances of Adobe ColdFusion were detected.");
    
    if (report_verbosity > 0)
    {
      report =
        '\nNessus detected the following unpatched instances :' +
        '\n' + join(instance_info, sep:'\n') +
        '\n';
      security_hole(port:port, extra:report);
    }
    else security_hole(port);
    

Packetstorm

Seebug

  • bulletinFamilyexploit
    descriptionNo description provided by source.
    idSSV:78621
    last seen2017-11-19
    modified2014-07-01
    published2014-07-01
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-78621
    titleAdobe ColdFusion APSB13-03 Remote Exploit
  • bulletinFamilyexploit
    descriptionNo description provided by source.
    idSSV:81348
    last seen2017-11-19
    modified2014-07-01
    published2014-07-01
    reporterRoot
    sourcehttps://www.seebug.org/vuldb/ssvid-81348
    titleAdobe ColdFusion 9 Administrative Login Bypass

The Hacker News

idTHN:94E632EBA2F2F8E0EE29D17E71E3261A
last seen2017-01-08
modified2013-11-13
published2013-11-13
reporterMohit Kumar
sourcehttp://thehackernews.com/2013/11/Adobe-Flash-ColdFusion-vulnerabilities-exploit-Hacker-News.html
titleSecurity updates for available for Adobe Flash Player and ColdFusion vulnerabilities