LoFP / in the wild, we have observed three different types of attempts that could potentially trigger false positives if the http status code is not in the query. these include: - \"/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/iedit.cfc?method=wizardhash&_cfclient=true&returnformat=wddx&inpassword=foo\" - \"/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/uploadedfiles/2u9uyvv qwp4pgazpjarz5vjgfpck.jsp\" - \"/cf_scripts/scripts/ajax/ckeditor/plugins/filemanager/upload.cfm\" these could be legitimate requests depending on the context of your organization. therefore, it is recommended to modify the analytic as needed to suit your specific environment.

Techniques

• T1190

Sample rules

Adobe ColdFusion Unauthenticated Arbitrary File Read

• source: splunk
• technicques:
  • T1190

Description

The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read. It monitors POST requests to the “/cf_scripts/scripts/ajax/ckeditor/*” endpoint using the Web datamodel. This activity can be significant due to the vulnerability’s high CVSS score of 9.8, indicating severe risk. If confirmed malicious, it could lead to unauthorized data access, further attacks, or severe operational disruptions.

Detection logic

| tstats `security_content_summariesonly`
  count min(_time) as firstTime
        max(_time) as lastTime

FROM datamodel=Web WHERE

Web.url="*/cf_scripts/scripts/ajax/ckeditor/*"
Web.status=200
Web.http_method=POST

BY Web.http_user_agent Web.status Web.http_method
   Web.url Web.url_length Web.src Web.dest


| `drop_dm_object_name("Web")`

| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `adobe_coldfusion_unauthenticated_arbitrary_file_read_filter`