ColdFusion

• programming language and a web app development platform
• now owned by Adobe
• CFML (ColdFusion Markup Language) is the language used in ColdFusion to create dynamic web apps.
  • similar to html
  • tags, db integration, web services, email, more
  • 
• 
• ColdFusion CVEs:
  • 
• Ports exposed by coldfusion service
  • 

ENUM

• PORT Scanning: 80/443
• File Extensions: .cmf or .cfc
• HTTP Headers: "Server: ColdFusion" or "X-Powered-By: ColdFusion"
• Error Messages: errors may contain references to ColdFusion-specific tags or functions.
• Default Files: admin.cfm or CFIDE/administrator/index.cfm

Attack

• searchsploit coldfusion 8
  • looks like directory traversal and rce

Directory Traversal

• try to find input fields - url parameters, form fields, cookies
• will give access to sensitive files - configuration files, user data, and other system files.
• [cf_root]/lib/password.properties

Unauth RCE

• change payload to have ip port