Adobe ColdFusion: Unrestricted file upload via CKEditor (CVE-2018-15961)

CVE-2018-15961 is a critical security vulnerability affecting Adobe ColdFusion versions 11.0, 2016, and 2018. The flaw resides in the CKEditor component, specifically within the upload.cfm file used for file management. Because the application fails to adequately validate or restrict the types of files being uploaded, an unauthenticated attacker can upload arbitrary files, including JSP shells, to the server. By navigating to the location of the uploaded file, the attacker can execute arbitrary code within the context of the ColdFusion service. The availability of multiple public exploits, including modules in Metasploit, increases the risk of exploitation. Defenders should verify that all Adobe ColdFusion instances have been updated according to Adobe Security Bulletin APSB18-33.

Attack Chain

1. Attacker performs reconnaissance to identify internet-facing Adobe ColdFusion servers.
2. Attacker crafts a multipart/form-data POST request targeting /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm.
3. Attacker includes a malicious payload (e.g., a JSP web shell) in the file form-data parameter.
4. Attacker provides a path argument in the path form-data parameter to define the destination of the uploaded file.
5. The server processes the request and saves the file to the web-accessible directory .../cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/.
6. Attacker sends an HTTP GET request to the path where the file was saved to trigger the execution of the embedded JSP code.
7. Attacker gains remote code execution on the underlying server to facilitate further malicious activity.

Impact

Successful exploitation results in full remote code execution on the target server. This allows an attacker to gain unauthorized access to sensitive data, establish persistence, pivot within the internal network, or deploy additional malware. The vulnerability has a CVSS score of 10.0, reflecting its severity, and has been subject to multiple public exploit releases over several years.

Recommendation

• Patch all Adobe ColdFusion instances to the versions specified in Adobe Security Bulletin APSB18-33.
• Implement a Web Application Firewall (WAF) rule to block POST requests directed at /cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm unless specifically required by business needs.
• Scan the directory .../cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedFiles/ for unrecognized JSP or executable files.
• Deploy the Sigma rule provided below to monitor for exploitation attempts targeting the vulnerable endpoint.