CVE-2017-3066 PoC — Adobe ColdFusion 安全漏洞

Source

https://github.com/cucadili/CVE-2017-3066

Associated Vulnerability

Title:Adobe ColdFusion 安全漏洞 (CVE-2017-3066)
Description:Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulnerability in the Apache BlazeDS library. Successful exploitation could lead to arbitrary code execution.

Description

The study of vulnerability CVE-2017-3066. Java deserialization

Readme

# CVE-2017-3066
## Description
Adobe ColdFusion uses message format the Action (AMF). The AMF Protocol is a custom binary serialization Protocol. It has two formats: AMF0 and AMF3. Action message consists of headers and bodies. There are several implementations of AMF in different languages. For Java we have Adobe BlazeDS (now Apache BlazeDS) which is also used in Adobe ColdFusion.
Adobe Coldfusion is affected to a Java Deserialisation Flaw in its Apache BlazeDS Library when it handles untrusted Java Objects which further gives Attacker the permission to attack remotely as a Remote Code Execution Vulnerability.
## Vulnerable Version
![alt text](screen/vuln_version.PNG "Vulnerable Version")

## Update Version
![alt text](screen/update_version.PNG "Update Version")
## Comparison of vulnerable and updated version
WinMerge
Update files:
![alt text](screen/Update_flex.PNG "Update file")

The flex-messaging-core.jar library contains the class flex.messaging.validators.ClassDeserializationValidator that performs validation. Therefore, it was separately decompiled using the Java Decompiler and once again launched for comparison in WinMerge.

![alt text](screen/add_check.PNG "Add Check")

## Install
Install and Exploiting: <https://github.com/vulhub/vulhub/tree/master/coldfusion/CVE-2017-3066>

## Suricata
In the file "test.rules " presents a rule for the Suricata utility. The rule allows network traffic to detect exploitable vulnerabilities.
The rule is connected in the `/etc/suricata/suricata file.yaml`:
```
    default-rule-path: /etc/suricata 
    rule-files: 
     - test.rules
```
RUN:
```
suricata -c /etc/suricata/suricata.yaml –I ens33
```
Log `/var/log/suricata/fast.log`

Signature 79 73 6F 73 65 72 69 61 = ysoserial

File Snapshot


 [4.0K]  /data/pocs/eb66d1095ff5f660b0b6ce0d6e41942982c8b504
├── [1.7K]  README.md
├── [4.0K]  screen
│   ├── [114K]  add_check.PNG
│   ├── [ 71K]  Update_flex.PNG
│   ├── [ 27K]  update_version.PNG
│   └── [ 45K]  vuln_version.PNG
└── [ 149]  test.rules

1 directory, 6 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!