A newly disclosed vulnerability in Adobe ColdFusion could be exploited by unprivileged users for the execution of arbitrary code with SYSTEM privileges.
The popular commercial web-application development platform uses the CFML scripting language and is mainly used for the creation of data-driven websites.
This week, Will Dormann, a security researcher with Carnegie Mellon University’s CERT Coordination Center (CERT/CC), revealed that the Adobe ColdFusion installer doesn’t create a secure access-control list (ACL) on the default installation directory.
Due to the lack of properly set ACL, any unprivileged user could create files in the platform’s directory structure, which leads to a privilege escalation security flaw.
An unprivileged user on a Windows computer, Dormann explains, could place a specially-crafted DLL file within the installation directory of Adobe ColdFusion, which would result in arbitrary code being executed with SYSTEM privileges. This type of attack is known as DLL hijacking.
Threat actors who have already established a foothold on a Windows machine running a vulnerable ColdFusion installation could target this vulnerability to execute malicious code with elevated privileges.
In the vulnerability note published on CERT/CC’s website, Dormann explains that mitigation steps for the security issue involve the use of the ColdFusion Server Auto-Lockdown installer.
“By default, ColdFusion does not configure itself securely. In order to secure ColdFusion with respect to service privileges, ACLs, and other attributes, the ColdFusion Server Auto-Lockdown installer must be installed in addition to installing ColdFusion itself,” he notes.
Mitigations vary depending on the ColdFusion version in use: while auto-lockdown installers are available for ColdFusion 2018 and ColdFusion 2021, users of ColdFusion 2016 will have to apply the changes that Adobe has detailed in the ColdFusion 2016 Lockdown Guide.
Contacted by SecurityWeek, Adobe has confirmed the vulnerability: “Adobe worked with the researcher who brought this matter to our attention and mitigation steps are included within the researcher’s note.”
ColdFusion has long been a target of threat actors, and Adobe has patched at least a handful of vulnerabilities already exploited in attacks, either on Patch Tuesday or with out-of-band updates.
Applying the mitigation steps for the newly discovered vulnerability as soon as possible will help users ensure their systems are not exposed to attacks.
Related: Adobe Releases First Security Updates of 2021 as It Blocks Flash Content
Related: Adobe Patches Flaws in ColdFusion, After Effects, Digital Editions