Vulnerabilities > CVE-2016-4264 - XXE vulnerability in Adobe Coldfusion 10.0/11.0
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
PARTIAL Integrity impact
PARTIAL Availability impact
NONE Summary
The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 3 |
Common Weakness Enumeration (CWE)
Exploit-Db
| description | Adobe ColdFusion < 11 Update 10 - XML External Entity Injection. CVE-2016-4264. Webapps exploit for Multiple platform |
| file | exploits/multiple/webapps/40346.py |
| id | EDB-ID:40346 |
| last seen | 2016-09-08 |
| modified | 2016-09-07 |
| platform | multiple |
| port | |
| published | 2016-09-07 |
| reporter | Dawid Golunski |
| source | https://www.exploit-db.com/download/40346/ |
| title | Adobe ColdFusion < 11 Update 10 - XML External Entity Injection |
| type | webapps |
Nessus
| NASL family | Windows |
| NASL id | COLDFUSION_WIN_APSB16-30.NASL |
| description | The version of Adobe ColdFusion running on the remote Windows host is missing a security hotfix. It is, therefore, affected by an XML External Entity (XXE) injection vulnerability due to an incorrectly configured XML parser accepting XML external entities from an untrusted source. An unauthenticated, remote attacker can exploit this, via specially crafted XML data, to disclose sensitive information. |
| last seen | 2020-06-01 |
| modified | 2020-06-02 |
| plugin id | 93245 |
| published | 2016-08-31 |
| reporter | This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof. |
| source | https://www.tenable.com/plugins/nessus/93245 |
| title | Adobe ColdFusion XML External Entity (XXE) Injection Information Disclosure (APSB16-30) |
| code | |
Packetstorm
| data source | https://packetstormsecurity.com/files/download/138621/adobecoldfusion-xxe.txt |
| id | PACKETSTORM:138621 |
| last seen | 2016-12-05 |
| published | 2016-09-07 |
| reporter | Dawid Golunski |
| source | https://packetstormsecurity.com/files/138621/Adobe-ColdFusion-11-XML-External-Entity-Injection.html |
| title | Adobe ColdFusion 11 XML External Entity Injection |
Seebug
bulletinFamily exploit description - Discovered by: Dawid Golunski - http://legalhackers.com - dawid (at) legalhackers.com - APSB16-30 - Release date: 31.08.2016 ### I. VULNERABILITY Adobe ColdFusion <= 11 XML External Entity (XXE) Injection ### II. BACKGROUND "Adobe ColdFusion 11 Enterprise Edition offers a single platform to rapidly build and deploy scalable, high-performing web and mobile applications. Leverage unique capabilities to develop, test, and debug mobile applications end to end. Generate high-quality PDF files and manipulate them easily." http://www.adobe.com/products/coldfusion-family.html ColdFusion is widely deployed. A google search for a ColdFusion index file (index.cfm) exposes over 30 million websites of various sectors that make use of ColdFusion platform in a visible way: https://www.google.com/?q=inurl:%2Findex.cfm including various government websites: https://www.google.com/search?q=inurl:index.cfm+site:gov ### III. INTRODUCTION An independent research revealed that Adobe ColdFusion in versions 11 and below is vulnerable to XXE Injection when processing untrusted office documents. Depending on web application's functionality and the attacker's ability to supply a malicious document to be processed by a vulnerable ColdFusion application, this vulnerability may potentially be exploited by both low-privileged and unauthenticated remote attackers. This vulnerability can allow various attacks including: - reading arbitrary files (stored on the server and within the network shares) - listing web/system directories - SSRF attacks / unauthorized access to restricted services running on the localhost as well as within the victim's server network - SMB relay attacks - temporary file uploads which may be used by attackers in combination with LFI vulnerabilities to supply malicious code This advisory provides a PoC exploit that demonstrates how a remote attacker could read arbitrary files from the target server, as well as list directories. Ability to read arbitrary files could for example let attackers extract sensitive information such as ColdFusion password hashes of the management console or stored database credentials. This could allow unauthorized access to weakly protected ColdFusion management interfaces and let attackers upload malicious code which could be used to fully compromise the server. ### IV. DESCRIPTION The XXE vulnerability was found in the Office Open XML (OOXML) processing functions which are utilised when opening documents that use XML structure. Documents that are commonly stored in this format include: - DOCX (Word documents) - XLSX (Excel spreadsheets) - PPTX (PowerPoint presentations) More information about the format can be found in: https://en.wikipedia.org/wiki/Office_Open_XML The vulnerability is caused by an unrestricted XML parser which allows for external XML entities processing when parsing such document. Many web applications often accept OOXML documents from their users to process documents of various purposes, for example: - invoices - bank statements - bills - tax forms - inventory - CVs / cover letters - application forms etc. Such upload functionality is often exposed to low-privileged or even unauthenticated remote users. If an attacker is able to upload a specially crafted OOXML document which is later processed by an application written in Adobe ColdFusion, they may be able to perform various malicious actions including arbitrary file reading and directory listing as mentioned in the introduction. This could for example be used by malicious users to read sensitive ColdFusion config files such as: - neo-security.xml , which stores ColdFusion admin's password hash salt - password.properties , which stores admin's password hash - neo-datasource.xml , which stores database credentials that are stored in c:\ColdFusion11\cfusion\lib\ directory by default on Windows installations. Attackers might also access the application sourcecodes within the documentroot: c:\ColdFusion11\cfusion\wwwroot or access other sensitive system files available within the system. As the vulnerability also allows browsing the filesystem and its directories, attackers may easily find interesting files and ColdFusion config/webroot directories even if the paths differ from the default ones. Attackers who have gained access to password hashes could then proceed to cracking them in order to gain unauthorised access to the databases and ColdFusion administrator panels to fully compromise the target. More information on hashes used by ColdFusion 11 can be found in the references below. The next section presents a PoC exploit that can be used for file/directory retrieval. The exploit will work even if the target ColdFusion application does not return any data back to the attacker upon processing a malicious document file. The extracted data will be sent over the network back to the attacker as soon as the document file is processed. #### V. PROOF OF CONCEPT EXPLOIT An example vulnerable ColdFusion application written in CFML language which loads a spreadsheet document could look as follows: ---[ vulnerable.cfm ]--- ``` <cfspreadsheet format="csv" action="read" src="#expandPath( 'cf_poc_exploit.xlsx' )#" name="xlsdoc" rows="1-4" /> <cfoutput>#xlsdoc#</cfoutput> ``` For simplicity, this ColdFusion application will load cf_poc_exploit.xlsx document from the current directory. In a real-world situation the application would allow a user to upload a document from their disk or alternatively fetch it from a URL. Attacker could use the exploit below to prepare a malicious document and supply it to a vulnerable ColdFusion application. Disclaimer: For testing purposes only. Do no harm. Full advisory URL: http://legalhackers.com/advisories/Adobe-ColdFusion-11-XXE-Exploit-CVE-2016-4264.txt id SSV:92397 last seen 2017-11-19 modified 2016-09-09 published 2016-09-09 reporter Root source https://www.seebug.org/vuldb/ssvid-92397 title Adobe ColdFusion < 11 Update 10 - XML external entity injection bulletinFamily exploit description ### Exploiting Adobe ColdFusion before CVE-2017-3066 In a recent penetration test my teammate Thomas came across several servers running Adobe ColdFusion 11 and 12. Some of them were vulnerable to CVE-2017-3066 but no outgoing TCP connections were possible to exploit the vulnerability. He asked me whether I had an idea how he could still get a SYSTEM shell and the outcome of the short research effort is documented here. ### INTRODUCTION ADOBE COLDFUSION & AMF Before we go into technical details, I will give you a short intro to Adobe ColdFusion (CF). Adobe ColdFusion is an Application Development Platform like ASP.net, however several years older. Adobe ColdFusion allows a developer to build websites, SOAP and REST web services and interact with Adobe Flash using the Action Message Format (AMF). The AMF protocol is a custom binary serialization protocol. It has two formats, AMF0 and AMF3. An Action Message consists of headers and bodies. Several data types are supported in AMF0 and AMF3. For example the AMF3 format supports the following protocol elements with their type identifier: ``` Undefined - 0x00 Null - 0x01 Boolean - 0x02 Boolean - 0x03 Integer - 0x04 Double - 0x05 String - 0x06 XML - 0x07 Date - 0x08 Array - 0x09 Object - 0x0A XML End - 0x0B ByteArray - 0x0C ``` Details about the binary message formats of AMF0 and AMF3 can be found on Wikipedia (see https://en.wikipedia.org/wiki/Action_Message_Format). There are several implementations for AMF in different languages. For Java we have Adobe BlazeDS (now Apache BlazeDS), which is also used in Adobe ColdFusion. The BlazeDS AMF serializer can serialize complex object graphs. The serializer starts with the root object and serializes its members recursively. Two general serialization techniques are supported by BlazeDS to serialize complex objects: * Serialization of Bean Properties (AMF0 and AMF3) * Serialization using Java's java.io.Externalizable interface. (AMF3) ### Serialization of Bean Properties This technique requires the object to be serialized to have a public no-arg constructor and for every member public Getter-and Setter-Methods (JavaBeans convention). In order to collect all member values of an object, the AMF serializer invokes all Getter-methods during serialization. The member names and values are put in the Action message body with the class name of the object. During deserialization, the classname is taken from the Action Message, a new object is constructed and for every member name the corresponding set method is called with the value as argument. This all happens either in method readScriptObject() of class flex.messaging.io.amf.Amf3Input or readObjectValue() of class flex.messaging.io.amf.Amf0Input. ### Serialization using Java's java.io.Externalizable interface BlazeDS further supports serialization of complex objects of classes implementing the java.io.Externalizable interface which inherits from java.io.Serializable. ``` public abstract interface Externalizable extends Serializable { public abstract void writeExternal(ObjectOutput paramObjectOutput) throws IOException; public abstract void readExternal(ObjectInput paramObjectInput) throws IOException, ClassNotFoundException; } ``` Every class implementing this interface needs to provide its own logic to deserialize itself by calling methods on the java.io.ObjectInput-implementation to read serialized primitive types and Strings (e.g. method read(byte[] paramArrayOfByte)). During deserialization of an object (type 0xa) in AMF3, the method readScriptObject() of class flex.messaging.io.amf.Amf3Input gets called. In line #759 the method readExternalizable is invoked which calls the readExternal() method on the object to be deserialized. ``` /* */ protected Object readScriptObject() /* */ throws ClassNotFoundException, IOException /* */ { /* 736 */ int ref = readUInt29(); /* */ /* 738 */ if ((ref & 0x1) == 0) { /* 739 */ return getObjectReference(ref >> 1); /* */ } /* 741 */ TraitsInfo ti = readTraits(ref); /* 742 */ String className = ti.getClassName(); /* 743 */ boolean externalizable = ti.isExternalizable(); /* */ /* */ /* */ /* 747 */ Object[] params = { className, null }; /* 748 */ Object object = createObjectInstance(params); /* */ /* */ /* 751 */ className = (String)params[0]; /* 752 */ PropertyProxy proxy = (PropertyProxy)params[1]; /* */ /* */ /* 755 */ int objectId = rememberObject(object); /* */ /* 757 */ if (externalizable) /* */ { /* 759 */ readExternalizable(className, object); //<- call to readExternal /* */ } /* */ //... /* */ } ``` This should be sufficient to serve as an introduction to Adobe ColdFusion and AMF. ### PREVIOUS WORK Chris Gates (@Carnal0wnage) published the paper ColdFusion for Pentesters which is an excellent introduction to Adobe ColdFusion. Wouter Coekaerts (@WouterCoekaerts) already showed in his blog post that deserializing untrusted AMF data is dangerous. Looking at the history of Adobe ColdFusion vulnerabilities at Flexera/Secunia's database you can find mostly XSS', XXE's and information disclosures. The most recent ones are: * Deserialization of untrusted data over RMI (CVE-2017-11283/4 by @nickstadb) * XXE (CVE-2017-11286 by Daniel Lawson of @depthsecurity) * XXE (CVE-2016-4264 by @dawid_golunski) ### CVE-2017-3066 In 2017 Moritz Bechler of AgNO3 GmbH and my teammate Markus Wulftange discovered independently the vulnerability CVE-2017-3066 in Apache BlazeDS. The core problem of this vulnerability was that Adobe Coldfusion never did any whitelisting of allowed classes. Thus any class in the classpath of Adobe ColdFusion, which either fulfills the Java Beans Convention or implements java.io.Externalizable could be sent to the server and get deserialized. Both Moritz and Markus found JRE classes (sun.rmi.server.UnicastRef2 sun.rmi.server.UnicastRef) which implemented the java.io.Externalizable interface and triggered an outgoing TCP connection during AMF3 deserialization. After the connection was made to the attacker's server, its response was deserialized using Java's native deserialization using ObjectInputStream.readObject(). Both found a great "bridge" from AMF deserialization to Java's native deserialization which offers well known exploitation primitives using public gadgets. Details about the vulnerability can also be found in Markus' blog post. Apache introduced validation through the class flex.messaging.validators.ClassDeserializationValidator. It has a default whitelist but can also be configured with a configuration file. For details see the Apache BlazeDS release notes. ### FINDING EXPLOITATION PRIMITIVES BEFORE CVE-2017-3066 As already mentioned in the very beginning my teammate Thomas required an exploit which also works without outgoing connection. I had a quick look into the excellent research paper "Java Unmarshaller Security" of Moritz Bechler where he analysed several "Unmarshallers" including BlazeDS. The exploitation payloads he discovered weren't applicable since the libraries were missing in the classpath. So I started with my typical approach, fired up my favorite "reverse engineering tool" when it comes to Java, Eclipse. Eclipse together with the powerful decompiler plugin "JD-Eclipse" (https://github.com/java-decompiler/jd-eclipse) is all you need for static and dynamic analysis. As a former Dev I was used to work with IDE's which make your life easier and decompiling and grepping through code is often very inefficient and error prone. So I created a new Java project and added all jar-files of Adobe Coldfusion 12 as external libraries. The first idea was to look for further calls to Java's ObjectInputStream.readObject-method. Using Eclipse this is very easy. Just open class ObjectInputStream, right click on the readObject() method and click "Open Call Hierarchy". Thanks to JD-Eclipse and its decompiler, Eclipse is able to construct call graphs based on class information without having any source. The call graph looks big in the very beginning. But with some experience you see very quickly which nodes in the graph are interesting. After some hours I found two promising call graphs. ### SETTER-BASED EXPLOIT The first one starts with method setState(byte[] new_state) of class org.jgroups.blocks.ReplicatedTree.  Looking at the implementation of this method, we already can imagine what is happening in line #605. ``` /* */ public void setState(byte[] new_state) /* */ { /* 597 */ Node new_root = null; /* */ /* */ /* 600 */ if (new_state == null) { /* 601 */ if (log.isInfoEnabled()) log.info("new cache is null"); /* 602 */ return; /* */ } /* */ try { /* 605 */ Object obj = Util.objectFromByteBuffer(new_state); /* 606 */ new_root = (Node)((Node)obj).clone(); /* 607 */ root = new_root; /* 608 */ notifyAllNodesCreated(root); /* */ } /* */ catch (Throwable ex) { /* 611 */ if (log.isErrorEnabled()) { log.error("could not set cache: " + ex); /* */ } /* */ } /* */ } ``` A quick look at the call graph confirms that we eventually end up in a call to ObjectInputStream.readObject(). The only thing to mention here is that the byte[] passed to setState() needs to have an additional byte 0x2 at offset 0x0 as we can see from line 364 of class org.jgroups.util.Util. ``` /* */ public static Object objectFromByteBuffer(byte[] buffer, int offset, int length) throws Exception /* */ { /* 358 */ if (buffer == null) return null; /* 359 */ if (JGROUPS_COMPAT) /* 360 */ return oldObjectFromByteBuffer(buffer, offset, length); /* 361 */ Object retval = null; /* 362 */ InputStream in = null; /* 363 */ ByteArrayInputStream in_stream = new ByteArrayInputStream(buffer, offset, length); /* 364 */ byte b = (byte)in_stream.read(); /* */ try { /* */ int len; /* 367 */ switch (b) { /* */ case 0: /* 369 */ return null; /* */ case 1: /* 371 */ in = new DataInputStream(in_stream); /* 372 */ retval = readGenericStreamable((DataInputStream)in); /* 373 */ break; /* */ case 2: /* 375 */ in = new ObjectInputStream(in_stream); /* 376 */ retval = ((ObjectInputStream)in).readObject(); /* */ //... /* */ } /* */ } /* */ } ``` The exploit can be found in the following image.  The exploit works against Adobe ColdFusion 12 only since JGroups is only available in this specific version. ### EXTERNALIZABLE-BASED EXPLOIT The second call graph starts in class org.apache.axis2.util.MetaDataEntry with a call to readExternal which is what we are looking for.  In line #297 we have a call to SafeObjectInputStream.install(inObject). ``` /* */ public static SafeObjectInputStream install(ObjectInput in) /* */ { /* 62 */ if ((in instanceof SafeObjectInputStream)) { /* 63 */ return (SafeObjectInputStream)in; /* */ } /* 65 */ return new SafeObjectInputStream(in) ; /* */ } view rawsnippet_org.apache.axis2.context.externalize.SafeObjectInputStream.java hosted with ❤ by GitHub In this function our AMF3Input instance gets wrapped by a org.apache.axis2.context.externalize.SafeObjectInputStream instance. /* */ private Object readObjectOverride() /* */ throws IOException, ClassNotFoundException /* */ { /* 318 */ boolean isActive = in.readBoolean(); /* 319 */ if (!isActive) { /* 320 */ if (isDebug) { /* 321 */ log.debug("Read object=null"); /* */ } /* 323 */ return null; /* */ } /* 325 */ Object obj = null; /* 326 */ boolean isObjectForm = in.readBoolean(); /* 327 */ if (isObjectForm) /* */ { /* 329 */ if (isDebug) { /* 330 */ log.debug(" reading using object form"); /* */ } /* 332 */ obj = in.readObject(); /* */ } else { /* 334 */ if (isDebug) { /* 335 */ log.debug(" reading using byte form"); /* */ } /* */ /* 338 */ ByteArrayInputStream bais = getByteStream(in); /* */ /* */ /* 341 */ ObjectInputStream tempOIS = createObjectInputStream(bais); /* 342 */ obj = tempOIS.readObject(); /* 343 */ tempOIS.close(); /* 344 */ bais.close(); /* */ } /* */ //... /* */ } ``` In line #341 a new instance of class org.apache.axis2.context.externalize.ObjectInputStreamWithCL is created. This class just extends the standard java.io.ObjectInputStream. In line #342 we finally have our call to readObject(). The following image shows the request for the exploit.  The exploit works against Adobe ColdFusion 11 and 12. ### COLDFUSIONPWN To make your life easier I created the simple tool ColdFusionPwn. It works on the command line and allows you to generate the serialized AMF message. It incorporates Chris Frohoff's ysoserial for gadget generation. It can be found on our github. ### TAKEAWAYS Deserializing untrusted input is bad, that's for sure. From an exploiters perspective exploiting deserialization vulnerabilities is a challenging task since you need to find the "right" objects (gadgets) which trigger functionality you can reuse for exploitation. But it's also more fun :-) By the way: If you want to make a deep dive into serverside Java Exploitation and all sorts of deserialization vulnerabilities and how to do proper static and dynamic analysis in Java, you might be interested in our upcoming "Advanced Java Exploitation" course. id SSV:97208 last seen 2018-03-31 modified 2018-03-30 published 2018-03-30 reporter Root title Adobe ColdFusion 反序列化漏洞（CVE-2017-3066）
References
- http://legalhackers.com/advisories/Adobe-ColdFusion-11-XXE-Exploit-CVE-2016-4264.txt
- http://www.securityfocus.com/archive/1/539374/100/0/threaded
- http://www.securityfocus.com/bid/92684
- http://www.securitytracker.com/id/1036708
- https://helpx.adobe.com/security/products/coldfusion/apsb16-30.html
- https://www.exploit-db.com/exploits/40346/