POC详情： f38cb21dd2ac7ac5e64076c6c1e6d73718d31960

来源
https://github.com/yoryio/CVE-2024-20767
关联漏洞
标题： Adobe ColdFusion 访问控制错误漏洞 (CVE-2024-20767)
描述：Adobe ColdFusion是美国奥多比（Adobe）公司的一套快速应用程序开发平台。该平台包括集成开发环境和脚本语言。 Adobe ColdFusion 2023.6, 2021.12 版本及之前版本存在访问控制错误漏洞，该漏洞源于存在不正确的访问控制漏洞，可能导致任意文件系统读取。
描述
Exploit for CVE-2024-20767 - Adobe ColdFusion
介绍
# CVE-2024-20767

### [CVE-2024-20767](https://nvd.nist.gov/vuln/detail/CVE-2024-20767) - Arbitrary file system read using an Improper Access Control vulnerability in Adobe ColdFusion

- Please refer to **ma4ter** blogpost for more information: [Adobe ColdFusion任意文件读取漏洞CVE-2024-20767分析](https://jeva.cc/2973.html)

![adobecoldfusionlogo](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifs-eKZwEeCs01XEwWXs4KI4C-oz4drQ5UWGtBjFnbaeA2FQL3Gz9HoxifqYA2wXAN-FikPbNSJN4QqpHp0UG0zSSW7vpc4M1ss9gbkj8Nf6KjaDI7692QF5kol_8mpsghR8wkneLfCSEZarLq1JlINquinyxt6Bl8UMV-BkjY2UN1dyHiJvPBmHePvgRf/s728-rw-e30/cf.jpg)

*Products and Versions affected:*


| Product  | Affected Versions |
| :--------| :---------------- |
| ColdFusion 2023 | Update 6 and earlier versions |
| ColdFusion 2021 | Update 12 and earlier versions |

- **CVSS:** 8.2
- **Actively Exploited:** NO
- **Patch:** [YES](https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html)
- **Mitigation:** NO

# Lab

You can deploy a ColdFusion server with a Free Trial from Adobe:

- [Download ColdFusion](https://helpx.adobe.com/coldfusion/kb/coldfusion-downloads.html#download0)

# Help

```
usage: CVE-2024-20767.py [-h] -t TARGET [-p PORT] -c COMMAND

options:
  -h, --help            show this help message and exit
  -t TARGET, --target TARGET
                        Target Adobe ColdFusion Server URL
  -p PORT, --port PORT  Target Adobe ColdFusion Server Port, by default we use the 8500 Port
  -c COMMAND, --command COMMAND
                        Path to read file
```


**Example:** 

```
python CVE-2024-20767.py -t http://192.168.124.203 -p 8500 -c Windows/ServerStandardEval.xml
```

# References

- [Adobe ColdFusion任意文件读取漏洞CVE-2024-20767分析](https://jeva.cc/2973.html)
- [CVE-2024-20767: Critical Adobe ColdFusion Flaw Exposes Sensitive Files, PoC Published](https://securityonline.info/cve-2024-20767-critical-adobe-coldfusion-flaw-exposes-sensitive-files-poc-published/)
- [Security updates available for Adobe ColdFusion | APSB24-14](https://helpx.adobe.com/security/products/coldfusion/apsb24-14.html)
文件快照

 [4.0K]  /data/pocs/f38cb21dd2ac7ac5e64076c6c1e6d73718d31960
├── [1.8K]  CVE-2024-20767.py
└── [2.1K]  README.md

0 directories, 2 files
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。