Announcing ColdFusion emergency update released March 14 2023: what to do about it

Thanks Jos. Such feedback is very much appreciated.

Thanks, Charlie. Your thoroughness is appreciated, as always.

Question...the CF Admin has an option "Enable mobile's server workflow" to turn on/off. If this is turned off, is the server still vunerable?

Charlie, I can't imagine being so confident in CF without all of the amazing insights and work that you do to support the community. Thank you!

Wow, lots of questions, and too many for me to answer at once. Let me take them one at a time, and it will be between client engagements, so apologies for the delay that there will be.

Matt, no, removing cf_scripts is NOT the solution to this problem and it would not help. And yes, I mean even if you or someone you know found evidence that that was used to perpetrate that "specifically crafted URL" I hinted at.

Let me be clear: it's NOT the files in that folder that ARE allowing the hack. So no, the bad guys could use other files. I will have to leave it at that.

Bottom line, it's the _cfclient querystring that is the key to the problem, not the files used in referring to it. I know I'm not giving enough detail for folks to figure things out: and that's the point.

As for the jvm arg, no. As I note in the post, that is NOT something you can "just do" in CF2016. It will mean NOTHING to CF 2016 or 11, or to CF2021 or 2018 before the update is applied. The jvm arg is for someone who APPLIES this update and yet DOES want to be able to use cfclient.

Finally, as for you asking how to remove it from old servers, I'm not aware of any way to. Again, this problem is inherent in how CF itself processed that _cfclient querystring, not some page that was called.

So someone on CF2016 (or 11) should use the other approach I offered, of simply blocking that _cfclient query string. I made that clear. I think you're trying to consider some potential corner cases or alternatives that I might have missed. I get it.

But please let me know if you now feel that you have all the info you need to proceed safely.

John, Rich, and GC, thanks very much for the kind regards! :-)

We have CF2016 servers so the advice from Charlie is very much appreciated. I'm so glad the "fix" was easy to do. Thank you for providing this info and confirming it works. You're completely right not to give too much away about how exactly the hack works.

Thank you so much for this blog post. It had just the right amount of information. Did you see that Adobe also released several other updates for other products with similar wording to the coldfusion bulletin? https://helpx.adobe....

Charlie, thank you as always for keeping us informed on these important updates. We don't see this level of information/detail from Adobe, which really would be helpful. Regardless, we are grateful for you.

Thanks as always Charlie for the helpful information. We immediately put the quick fix into place for IIS and Apache, and installed the 2021 update over the weekend. Appreciate the detailed information.

I want to add an update that Rapid7 came out with a blog post/announcement today about a CF vuln:

https://www.rapid7.c...

...but they don't connect it readily to this one. Even so, I am fairly confident that what they are finding is the RESULTING bad-guy file that I discussed in this post as the second aspect of the vuln (the "arbitrary code execution", or their ability to cause placement of a bad-guy file on your server.)

Sadly, the Adobe technote and PSIRT/APSB bulletin as well as Mitre CVE's don't give enough detail to readily allow Rapid7 and others to connect the dots to this vuln and the update from last week. And they likely are unaware of my post here.

But I wanted to point this out in case others finding or following this post may "wonder" if that is some "new hack". I really don't think so. Once those folks dig further they should find that the root cause was this _cfclient querystring and the rest of the "specifically crafted url" (which I can't share, as it would allow perpetration of the hack).

Bottom line: get your CF2021 and 2018 updated to the March updates (6 and 16, respectively), or get the block of the _cfclient querystring var in place, all as discussed above.

I assume the "this" is this post (as the update definitely addresses both). As for your question, I'm afraid I can't really know. There's not enough detail in those CVEs to tell.

I suspect you're asking because in the apsb, my name is associated only with the one CVE. You're likely wondering if perhaps my post only covers SOME of the vulns identified in the apsb.

Again, bottom line: folks should apply the update (which clearly prevents the very serious hack as I'd reported to them days before), or implement at least the block I'd offered--whatever is the cve/s that it relates to. I'm afraid Adobe just didn't offer more to help on your question.

It absolutely does. I also don't understand their scoring or attribution. But I can say with 100% confidence that this update prevents the vulnerability I describe, including both the arbitrary file read and the arbitrary code execution.

The class files are evidence of the hack having been perpetrated, they are NOT the MEANS of the attack, anymore than a fingerprint should be defended against in a crime.

The thing to defend against is the _cfclient in the query string, as discussed (to death) in the post. Here again, the mere presence of that string is not THE HACK, but it's the WAY it's used: just like how a gun in a robbery alone will not kill or wound anyone, but can be USED to do so.

Since these questions remain for you, I think you'd find value in reading the post again, from the top. It was a LOT to take in. I'd hope on second reading any questions would be more completely answered.

It's certainly an interesting effort they've done. They're concluding attack effort is indeed something quite different from what the hackers I saw did, though what they shown is bad enoug).

Some will benefit from their effort, sure, but of course some will also use it to effect perpetration.

I was careful NOT to show the "how", but we can't control what others may say and do. Anyway, thanks for the heads up.

Thanks, Bill, and glad to have helped! :-)

Thanks, Mike. And to that verbiage you quote, it's an understandable question/confusion.

It's simply there in every CF update--because SOMETIMES an update they do MAY presume to leverage also some aspect of a latest JVM version. But note they are not specific about that (ever), and I am not aware of this fix having anything to do with Java.

That said, given that CF runs on Java it is indeed always wise to run on the latest update of the JVM version which your CF version supports (for the sake of its own security and bug fixes). And for CF2021 and 2018, that is currently (only) Java 11: and the latest 11 is 11.0.18 which came out in January. (11.0.19 will come out next week, FWIW.)

Before you may update the JVM, note that I did a blog post on that 11.0.18 update where I mentioned 3 related issues: one for people moving to 11.0.17 or above, one for people moving to 11.0.11 or above (but you're already there), and one for anyone running the JDK installer for 11.0.18 or above. See that post here:

https://www.carehart...

I would plan to do another post when the next JVM updates come out next week.