m-cetin/cve-2024-20767Python PoC exploit for CVE-2024-20767 enabling arbitrary file read on vulnerable Adobe ColdFusion servers via the Performance Monitoring Toolset endpoint.
get-the-files.py is a Python script that exploits a vulnerability in Adobe ColdFusion Servers (CVE-2024-20767) to read files from the server. The script is based on a method outlined at https://jeva.cc/2973.html.
This script is provided for educational purposes only. Unauthorized testing of servers, exploiting vulnerabilities without permission, and accessing or disclosing private data without consent are illegal and unethical activities. By using this script, you agree to do so within the bounds of the law and ethical guidelines. The author or contributors are not responsible for any misuse or damage caused by this script.
requests libraryBefore running the script, ensure you have Python 3.x installed on your system. You can download Python from the official website: https://www.python.org/downloads/.
To install the required requests library, run the following command:
pip install requests
The script can be executed from the command line by providing the necessary arguments.
python get-the-files.py --endpoints <URLs> --port <PORT> --command <FILE_PATH>
Arguments
python get-the-files.py --endpoints example.com another-example.com --port 8500 --command "/etc/passwd"
ColdFusion servers with the Performance Monitoring Toolset enabled (and accessible via /pms) running the following versions are vulnerable:
This script is released under the MIT License. See the LICENSE file for more details.
For any questions or concerns regarding this script, please open an issue on the GitHub repository.