• CVE(s): CVE-2019-8074
• Publish Date: 24 September 2019
• Vendor: Adobe
• Product: ColdFusion
• Version(s) affected: 2018 Update 4 and earlier versions, 2016 Update 11 and earlier versions
• Fixed version: 2018 Update 5, 2016 Update 12
• Author: Daniel Underhay

Adobe security bulletin details.

Path Traversal Vulnerability (CVE-2017-5219) #

By default, custom applications built using the Adobe ColdFusion platform would block access to the admin portal. Access is restricted (usually) based on IP address, which is added to an allowlist. Any attempts to access the admin portal (for example - https://example.com/CFIDE/administrator/index.cfm), will result in a redirect to the main page of the application.

Using ..;/ it was possible to bypass the access controls and access the ColdFusion admin portal.

For example:

https://example.com/..;/CFIDE/administrator/index.cfm

The idea came from watching a great talk from Orange Tsai on exploiting URL parsers. More info on this topic can be found here.