Vulnerability Disclosure - Adobe ColdFusion - Path Traversal Vulnerability

Publish date: September 24 2019
Vendor: Adobe
Product: ColdFusion
Versions affected: 2018 Update 4 and earlier versions, 2016 Update 11 and earlier versions
Fixed version: 2018 Update 5, 2016 Update 12
Author: Daniel Underhay

Adobe security bulletin details.

Path Traversal Vulnerability (CVE-2017-5219)

By default, custom applications built using the Adobe ColdFusion platform would block access to the admin portal. Access is restricted (usually) based on IP address, which is added to an allowlist. Any attempts to access the admin portal (for example -, will result in a redirect to the main page of the application.

Using ..;/ it was possible to bypass the access controls and access the ColdFusion admin portal.

For example:;/CFIDE/administrator/index.cfm

The idea came from watching a great talk from Orange Tsai on exploiting URL parsers. More info on this topic can be found here.