CVE-2020-10145
📋 TL;DR
This vulnerability in Adobe ColdFusion installer allows unprivileged users to create files in the default installation directory due to insecure ACL settings. This can lead to privilege escalation where attackers gain higher system privileges. Organizations using default ColdFusion installations on Windows are affected.
💻 Affected Systems
- Adobe ColdFusion
📦 What is this software?
Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →Coldfusion by Adobe
Adobe ColdFusion is a commercial rapid web application development platform and server providing a Java-based runtime environment for building dynamic websites, web applications, REST APIs, and enterprise integrations. Deployed across government agencies, financial services, healthcare organizations...
Learn more about Coldfusion →⚠️ Risk & Real-World Impact
Worst Case
Full system compromise where attackers gain administrative privileges, install persistent backdoors, and access sensitive data across the system.
Likely Case
Local privilege escalation allowing attackers to execute arbitrary code with elevated privileges, potentially leading to lateral movement within the network.
If Mitigated
Minimal impact if proper ACLs are set and least-privilege principles are followed, limiting file creation to authorized users only.
🎯 Exploit Status
Exploitation requires local access to the system. Attackers need to be able to create files in the vulnerable directory.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: ColdFusion updates released after the advisory
Vendor Advisory: https://helpx.adobe.com/security/products/coldfusion/apsb20-18.html
Restart Required: Yes
Instructions:
1. Apply the latest Adobe ColdFusion security update. 2. Restart the ColdFusion service. 3. Verify ACLs are properly set on installation directories.
🔧 Temporary Workarounds
Set Secure ACLs on ColdFusion Directory
windowsManually configure proper access control lists on the ColdFusion installation directory to restrict file creation to authorized users only.
icacls "C:\ColdFusion2021\" /inheritance:r /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "CREATOR OWNER:(OI)(CI)F" /T
🧯 If You Can't Patch
- Implement strict user privilege management and ensure no unprivileged users have access to ColdFusion servers
- Monitor file creation events in ColdFusion installation directories using file integrity monitoring tools
🔍 How to Verify
Check if Vulnerable:
Check if unprivileged users can create files in the ColdFusion installation directory using: icacls "C:\ColdFusion2021\"Check Version:
Check ColdFusion version in Administrator console or via cfusion\lib\coldfusion.jar manifestVerify Fix Applied:
Verify ACLs show proper restrictions and test that unprivileged users cannot create files in the directory.📡 Detection & Monitoring
Log Indicators:
- File creation events in ColdFusion directories by non-administrative users
- Unusual process execution from ColdFusion directories
Network Indicators:
- Unusual outbound connections from ColdFusion servers
- Lateral movement attempts from ColdFusion hosts
SIEM Query:
EventID=4663 AND ObjectName LIKE '%ColdFusion%' AND SubjectUserName NOT IN ('SYSTEM', 'Administrators')