Vulnerabilities > CVE-2013-0632 - Information Exposure vulnerability in Adobe Coldfusion
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 4 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Subverting Environment Variable Values The attacker directly or indirectly modifies environment variables used by or controlling the target software. The attacker's goal is to cause the target software to deviate from its expected operation in a manner that benefits the attacker.
- Footprinting An attacker engages in probing and exploration activity to identify constituents and properties of the target. Footprinting is a general term to describe a variety of information gathering techniques, often used by attackers in preparation for some attack. It consists of using tools to learn as much as possible about the composition, configuration, and security mechanisms of the targeted application, system or network. Information that might be collected during a footprinting effort could include open ports, applications and their versions, network topology, and similar information. While footprinting is not intended to be damaging (although certain activities, such as network scans, can sometimes cause disruptions to vulnerable applications inadvertently) it may often pave the way for more damaging attacks.
- Exploiting Trust in Client (aka Make the Client Invisible) An attack of this type exploits a programs' vulnerabilities in client/server communication channel authentication and data integrity. It leverages the implicit trust a server places in the client, or more importantly, that which the server believes is the client. An attacker executes this type of attack by placing themselves in the communication channel between client and server such that communication directly to the server is possible where the server believes it is communicating only with a valid client. There are numerous variations of this type of attack.
- Browser Fingerprinting An attacker carefully crafts small snippets of Java Script to efficiently detect the type of browser the potential victim is using. Many web-based attacks need prior knowledge of the web browser including the version of browser to ensure successful exploitation of a vulnerability. Having this knowledge allows an attacker to target the victim with attacks that specifically exploit known or zero day weaknesses in the type and version of the browser used by the victim. Automating this process via Java Script as a part of the same delivery system used to exploit the browser is considered more efficient as the attacker can supply a browser fingerprinting method and integrate it with exploit code, all contained in Java Script and in response to the same web page request by the browser.
- Session Credential Falsification through Prediction This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
Exploit-Db
description Adobe ColdFusion APSB13-03 - Remote Exploit. CVE-2013-0625,CVE-2013-0629,CVE-2013-0632. Remote exploits for multiple platform id EDB-ID:24946 last seen 2016-02-03 modified 2013-04-10 published 2013-04-10 reporter metasploit source https://www.exploit-db.com/download/24946/ title Adobe ColdFusion APSB13-03 - Remote Exploit description Adobe ColdFusion 9 - Administrative Login Bypass. CVE-2013-0632. Webapps exploit for windows platform id EDB-ID:27755 last seen 2016-02-03 modified 2013-08-21 published 2013-08-21 reporter Scott Buckel source https://www.exploit-db.com/download/27755/ title Adobe ColdFusion 9 - Administrative Login Bypass description Adobe ColdFusion 9 - Administrative Login Bypass. CVE-2013-0632. Remote exploits for multiple platform file exploits/multiple/remote/30210.rb id EDB-ID:30210 last seen 2016-02-03 modified 2013-12-11 platform multiple port 80 published 2013-12-11 reporter metasploit source https://www.exploit-db.com/download/30210/ title Adobe ColdFusion 9 - Administrative Login Bypass type remote
Metasploit
description Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication using the RDS component. Due to default settings or misconfiguration, its password can be set to an empty value. This allows an attacker to create a session via the RDS login that can be carried over to the admin web interface even though the passwords might be different, and therefore bypassing authentication on the admin web interface leading to arbitrary code execution. Tested on Windows and Linux with ColdFusion 9. id MSF:EXPLOIT/MULTI/HTTP/COLDFUSION_RDS_AUTH_BYPASS last seen 2020-06-08 modified 2019-10-31 published 2019-10-27 references reporter Rapid7 source https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/coldfusion_rds_auth_bypass.rb title Adobe ColdFusion RDS Authentication Bypass description Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication using the RDS component. Due to default settings or misconfiguration, its password can be set to an empty value. This allows an attacker to create a session via the RDS login that can be carried over to the admin web interface even though the passwords might be different, and therefore bypassing authentication on the admin web interface leading to arbitrary code execution. Tested on Windows and Linux with ColdFusion 9. id MSF:EXPLOIT/MULTI/HTTP/COLDFUSION_RDS last seen 2020-06-08 modified 2019-10-27 published 2013-12-10 references reporter Rapid7 source https://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/multi/http/coldfusion_rds.rb title Adobe ColdFusion 9 Administrative Login Bypass
Nessus
NASL family CGI abuses NASL id COLDFUSION_APSB13-03_AUTH_BYPASS.NASL description The version of Adobe ColdFusion running on the remote host is affected by an authentication bypass vulnerability. When RDS is disabled and not configured with password protection, it is possible to authenticate as an administrative user without providing a username or password. A remote, unauthenticated attacker can exploit this to gain administrative access to the ColdFusion Administrator interface. After authenticating, it is possible to write arbitrary files to the host, resulting in arbitrary code execution. This vulnerability is being exploited in the wild. This version of ColdFusion is reportedly affected by several additional vulnerabilities; however, Nessus has not checked for those issues. last seen 2020-06-01 modified 2020-06-02 plugin id 64689 published 2013-02-19 reporter This script is Copyright (C) 2013-2018 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/64689 title Adobe ColdFusion Authentication Bypass (APSB13-03) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(64689); script_version("1.18"); script_cvs_date("Date: 2018/11/15 20:50:16"); script_cve_id("CVE-2013-0632"); script_bugtraq_id(57330); script_xref(name:"EDB-ID", value:"24946"); script_xref(name:"EDB-ID", value:"27755"); script_xref(name:"EDB-ID", value:"30210"); script_name(english:"Adobe ColdFusion Authentication Bypass (APSB13-03)"); script_summary(english:"Bypasses authentication."); script_set_attribute(attribute:"synopsis", value: "A web management interface running on the remote host is affected by an authentication bypass vulnerability."); script_set_attribute(attribute:"description", value: "The version of Adobe ColdFusion running on the remote host is affected by an authentication bypass vulnerability. When RDS is disabled and not configured with password protection, it is possible to authenticate as an administrative user without providing a username or password. A remote, unauthenticated attacker can exploit this to gain administrative access to the ColdFusion Administrator interface. After authenticating, it is possible to write arbitrary files to the host, resulting in arbitrary code execution. This vulnerability is being exploited in the wild. This version of ColdFusion is reportedly affected by several additional vulnerabilities; however, Nessus has not checked for those issues."); script_set_attribute(attribute:"see_also", value:"https://forums.adobe.com/message/4962104"); # http://www.carehart.org/blog/client/index.cfm/2013/1/2/Part2_serious_security_threat script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?832b0298"); script_set_attribute(attribute:"see_also", value:"https://www.adobe.com/support/security/advisories/apsa13-01.html"); script_set_attribute(attribute:"see_also", value:"https://www.adobe.com/support/security/bulletins/apsb13-03.html"); # https://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix-apsb13-03.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a76b1a91"); script_set_attribute(attribute:"solution", value: "Apply the appropriate hotfix referenced in Adobe security bulletin APSB13-03."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Adobe ColdFusion 9 Administrative Login Bypass'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2012/12/28"); # forum post script_set_attribute(attribute:"patch_publication_date", value:"2013/01/15"); # APSB13-03 script_set_attribute(attribute:"plugin_publication_date", value:"2013/02/19"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:coldfusion"); script_set_attribute(attribute:"exploited_by_nessus", value:"true"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"CGI abuses"); script_copyright(english:"This script is Copyright (C) 2013-2018 Tenable Network Security, Inc."); script_dependencies("coldfusion_detect.nasl", "coldfusion_rds_detect.nasl"); script_require_keys("installed_sw/ColdFusion"); script_require_ports("Services/www", 80, 8500); exit(0); } include("audit.inc"); include("global_settings.inc"); include("http.inc"); include("misc_func.inc"); include("install_func.inc"); app = 'ColdFusion'; get_install_count(app_name:app, exit_if_zero:TRUE); port = get_http_port(default:80); install = get_single_install( app_name : app, port : port ); dir = install['path']; install_url = build_url(port:port, qs:dir); # In ColdFusion 9.x, the vulnerability exists if RDS is disabled. # In CF 10 it's present if RDS is disabled _and_ configured to not require # authentication. In the name of avoiding false positives and negatives, # this plugin will only bail out if RDS is enabled and authentication # is not required, an issue which is already reported by a different # plugin (coldfusion_rds_unauthenticated.nasl) rds_enabled = get_kb_item('coldfusion/' + port + '/rds/enabled'); if (rds_enabled) exit(0, "RDS is enabled on the " +app+ " install at " + install_url); # first, get a session ID as the admin user auth_url = '/adminapi/administrator.cfc?method=login&adminpassword=&rdsPasswordAllowed=true'; res = http_send_recv3(method:'GET', item:dir+auth_url, port:port, exit_on_fail:TRUE); # success: <wddxPacket version='1.0'><header/><data><boolean value='true'/></data></wddxPacket> # failure: <wddxPacket version='1.0'><header/><data><boolean value='false'/></data></wddxPacket> # if the server doesn't explicitly say the login failed, keep going just in case it worked and # an unexpected response was received if ('false' >< res[2]) audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_url); # request a page that requires authentication, in order to verify the auth bypass worked about_url = '/administrator/aboutcf.cfm'; res = http_send_recv3(method:'GET', item:dir+about_url, port:port, exit_on_fail:TRUE); if ( 'About ColdFusion Administrator' >!< res[2] && res[2] !~ 'Version: *(<[^>+>)([0-9,.]+)' ) { audit(AUDIT_WEB_APP_NOT_AFFECTED, app, install_url); } if (report_verbosity > 0) { report = '\nNessus was able to login without authenticating by requesting :\n\n' + install_url + auth_url + '\n' + '\nThe login was verified by requesting the following page, which' + '\nrequires authentication :\n\n' + install_url + about_url + '\n'; security_hole(port:port, extra:report); } else security_hole(port);
NASL family Windows NASL id COLDFUSION_WIN_APSB13-03.NASL description The version of Adobe ColdFusion running on the remote host is missing hotfixes that address the following vulnerabilities : - An authentication bypass vulnerability exists that could allow an unauthorized user to gain administrative access. (CVE-2013-0625) - A directory traversal vulnerability exists that could allow an unauthorized user to gain administrative access. (CVE-2013-0629) - An unspecified information disclosure vulnerability exists that affects servers that have already been compromised. (CVE-2013-0631) - Authentication bypass vulnerability exists that could allow an unauthorized user to gain administrative access. (CVE-2013-0632) last seen 2020-06-01 modified 2020-06-02 plugin id 66526 published 2013-05-21 reporter This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/66526 title Adobe ColdFusion Multiple Vulnerabilities (APSB13-03) (credentialed check) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(66526); script_version("1.10"); script_cvs_date("Date: 2019/11/27"); script_cve_id( "CVE-2013-0625", "CVE-2013-0629", "CVE-2013-0631", "CVE-2013-0632" ); script_bugtraq_id( 57164, 57165, 57166, 57330 ); script_xref(name:"EDB-ID", value:"24946"); script_xref(name:"EDB-ID", value:"27755"); script_name(english:"Adobe ColdFusion Multiple Vulnerabilities (APSB13-03) (credentialed check)"); script_summary(english:"Checks for hotfixes"); script_set_attribute(attribute:"synopsis", value: "A web-based application running on the remote Windows host is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Adobe ColdFusion running on the remote host is missing hotfixes that address the following vulnerabilities : - An authentication bypass vulnerability exists that could allow an unauthorized user to gain administrative access. (CVE-2013-0625) - A directory traversal vulnerability exists that could allow an unauthorized user to gain administrative access. (CVE-2013-0629) - An unspecified information disclosure vulnerability exists that affects servers that have already been compromised. (CVE-2013-0631) - Authentication bypass vulnerability exists that could allow an unauthorized user to gain administrative access. (CVE-2013-0632)"); script_set_attribute(attribute:"see_also", value:"https://forums.adobe.com/message/4962104"); # http://www.carehart.org/blog/client/index.cfm/2013/1/2/Part2_serious_security_threat script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?832b0298"); script_set_attribute(attribute:"see_also", value:"https://www.adobe.com/support/security/advisories/apsa13-01.html"); script_set_attribute(attribute:"see_also", value:"https://www.adobe.com/support/security/bulletins/apsb13-03.html"); # https://helpx.adobe.com/coldfusion/kb/coldfusion-security-hotfix-apsb13-03.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a76b1a91"); script_set_attribute(attribute:"solution", value: "Apply the appropriate hotfixes referenced in Adobe security bulletin APSB13-03."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2013-0632"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"exploit_framework_core", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Adobe ColdFusion 9 Administrative Login Bypass'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2012/12/28"); script_set_attribute(attribute:"patch_publication_date", value:"2013/01/15"); script_set_attribute(attribute:"plugin_publication_date", value:"2013/05/21"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:adobe:coldfusion"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows"); script_copyright(english:"This script is Copyright (C) 2013-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("coldfusion_win_local_detect.nasl"); script_require_keys("SMB/coldfusion/instance"); script_require_ports(139, 445); exit(0); } include("audit.inc"); include("coldfusion_win.inc"); include("global_settings.inc"); include("misc_func.inc"); include("smb_func.inc"); versions = make_list('9.0.0', '9.0.1', '9.0.2', '10.0.0'); instances = get_coldfusion_instances(versions); # this exits if it fails # Check the hotfixes and cumulative hotfixes installed for each # instance of ColdFusion. info = NULL; instance_info = make_list(); # a connection needs to be made to the system in order to call check_cfide_hotfix() port = kb_smb_transport(); login = kb_smb_login(); pass = kb_smb_password(); domain = kb_smb_domain(); if(! smb_session_init()) audit(AUDIT_FN_FAIL, 'smb_session_init'); cfide_file = "\CFIDE\adminapi\administrator.cfc"; searchterm = 'isRdsEnabled'; foreach name (keys(instances)) { info = NULL; ver = instances[name]; if (ver == "9.0.0") { info = check_cfide_hotfix(name, cfide_file, searchterm, 'CFIDE-9.zip'); remove = make_list("00001", "00002", "00003", "00004", "00005", "00006", "00007", "00008"); info += check_jar_hotfix(name, "00009", 2, remove); } else if (ver == "9.0.1") { info = check_cfide_hotfix(name, cfide_file, searchterm, 'CFIDE-901.zip'); remove = make_list("00001", "00002", "00003", "00004", "00005", "00006", "00007"); info += check_jar_hotfix(name, "00008", 3, remove); } else if (ver == "9.0.2") { info = check_cfide_hotfix(name, cfide_file, searchterm, 'CFIDE-902.zip'); remove = make_list("00001", "00002"); info += check_jar_hotfix(name, "00003", 1, remove); } else if (ver == "10.0.0") { # CF10 uses an installer for updates so it is less likely (perhaps not possible) to only partially install a hotfix. # this means the plugin doesn't need to check for anything in the CFIDE directory, it just needs to check the CHF level info = check_jar_chf(name, 7); } if (!isnull(info)) instance_info = make_list(instance_info, info); } NetUseDel(); if (max_index(instance_info) == 0) exit(0, "No vulnerable instances of Adobe ColdFusion were detected."); if (report_verbosity > 0) { report = '\nNessus detected the following unpatched instances :' + '\n' + join(instance_info, sep:'\n') + '\n'; security_hole(port:port, extra:report); } else security_hole(port);
Packetstorm
data source https://packetstormsecurity.com/files/download/121210/adobe_coldfusion_apsb13_03.rb.txt id PACKETSTORM:121210 last seen 2016-12-05 published 2013-04-10 reporter Jon Hart source https://packetstormsecurity.com/files/121210/Adobe-ColdFusion-APSB13-03-Command-Execution.html title Adobe ColdFusion APSB13-03 Command Execution data source https://packetstormsecurity.com/files/download/122864/PSA-2013-0819-2.txt id PACKETSTORM:122864 last seen 2016-12-05 published 2013-08-19 reporter Scott Buckel source https://packetstormsecurity.com/files/122864/Packet-Storm-Advisory-2013-0819-2-Adobe-ColdFusion-9-Administrative-Login-Bypass.html title Packet Storm Advisory 2013-0819-2 - Adobe ColdFusion 9 Administrative Login Bypass
Seebug
bulletinFamily exploit description No description provided by source. id SSV:78621 last seen 2017-11-19 modified 2014-07-01 published 2014-07-01 reporter Root source https://www.seebug.org/vuldb/ssvid-78621 title Adobe ColdFusion APSB13-03 Remote Exploit bulletinFamily exploit description No description provided by source. id SSV:81348 last seen 2017-11-19 modified 2014-07-01 published 2014-07-01 reporter Root source https://www.seebug.org/vuldb/ssvid-81348 title Adobe ColdFusion 9 Administrative Login Bypass
The Hacker News
id | THN:94E632EBA2F2F8E0EE29D17E71E3261A |
last seen | 2017-01-08 |
modified | 2013-11-13 |
published | 2013-11-13 |
reporter | Mohit Kumar |
source | http://thehackernews.com/2013/11/Adobe-Flash-ColdFusion-vulnerabilities-exploit-Hacker-News.html |
title | Security updates for available for Adobe Flash Player and ColdFusion vulnerabilities |