A newly disclosed vulnerability in Adobe ColdFusion might be exploited by unprivileged users for the execution of arbitrary code with SYSTEM privileges.
The popular commercial web-application development platform uses the CFML scripting language and is especially used for the creation of data-driven websites.
This week, Will Dormann, a security researcher with Carnegie Mellon University’s CERT Coordination Center (CERT/CC), revealed that the Adobe ColdFusion installer doesn’t create a secure access-control list (ACL) on the default installation directory.
Due to the lack of properly set ACL, any unprivileged user could create files in the platform’s directory structure, which leads to a privilege escalation security flaw.
An unprivileged user on a Windows computer, Dormann explains, could place a specially-crafted DLL file within the installation directory of Adobe ColdFusion, which might end in arbitrary code being executed with SYSTEM privileges. This type of attack is known as DLL hijacking.
Threat actors who have already established a foothold on a Windows machine running a vulnerable ColdFusion installation could target this vulnerability to execute malicious code with elevated privileges.
In the vulnerability note published on CERT/CC’s website, Dormann explains that mitigation steps for the safety issue involve the utilization of the ColdFusion Server Auto-Lockdown installer.
“By default, ColdFusion does not configure itself securely. In order to secure ColdFusion with reference to service privileges, ACLs, and other attributes, the ColdFusion Server Auto-Lockdown installer must be installed additionally to installing ColdFusion itself,” he notes.
Mitigations vary counting on the ColdFusion version in use: while auto-lockdown installers are available for ColdFusion 2018 and ColdFusion 2021, users of ColdFusion 2016 will need to apply the changes that Adobe has detailed in the ColdFusion 2016 Lockdown Guide.
Adobe has confirmed the vulnerability: “Adobe worked with the researcher who brought this interest to our attention and mitigation steps are included within the researcher’s note.”
ColdFusion has long been a target of threat actors, and Adobe has patched at least a handful of vulnerabilities already exploited in attacks, either on Patch Tuesday or with out-of-band updates.
Applying the mitigation steps for the newly discovered vulnerability as soon as possible will help users ensure their systems are not exposed to attacks.
