# Adobe ColdFusion 远程代码执行漏洞（CVE-2021-21087）

Adobe ColdFusion是一个快速应用程序开发平台。。Adobe ColdFusion 存在远程代码执行漏洞，由于过滤不严，未经授权的攻击者可构造恶意请求，造成任意代码执行，控制服务器。建议相关用户尽快采取安全措施阻止漏洞攻击。

影响范围

* Adobe ColdFusion 2021 <= Version 2021.0.0.323925
* Adobe ColdFusion 2018 <= Update 10
* Adobe ColdFusion 2016 <= Update 16

FOFA：

```
app="Adobe-ColdFusion"
```

PoC：

```
  - method: GET
    path:
      - "{{BaseURL}}/cf_scripts/scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/cf-scripts/scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/CFIDE/scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/cfide/scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/CF_SFSD/scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/cfide-scripts/ajax/package/cfajax.js"
      - "{{BaseURL}}/cfmx/CFIDE/scripts/ajax/package/cfajax.js"

regex:
          - 'eval\(\"\(\"\+json\+\"\)\"\)'
```

ref：

* https://nosec.org/home/detail/4707.html
* https://github.com/projectdiscovery/nuclei-templates/pull/1128/files
* https://helpx.adobe.com/security/products/coldfusion/apsb21-16.html