ColdFusion directory traversal (CVE-2010-2861)

CVE-2010-2861 is a directory traversal vulnerability in Adobe ColdFusion (versions 8 and 9, without the relevant patch). It affects several admin pages that accept an unsanitized locale parameter, among them CFIDE/administrator/enter.cfm. By manipulating that parameter you can escape the intended directory and read arbitrary files on the server, with no authentication.

The typical target is password.properties, the file where ColdFusion stores the hash of the admin panel password:

http://<ip>:8500/CFIDE/administrator/enter.cfm?locale=../../../../../../../../../../ColdFusion8/lib/password.properties%00en

Two details of the payload:

• The repeated ../ climb the tree to the root; some are extra on purpose (climbing too far is harmless, falling short doesn't reach).
• The %00 (null byte) truncates the string in old Java/ColdFusion versions, so the en suffix the application appends is discarded and the server serves the file as-is.

What you get is the admin hash, usually an unsalted SHA1. From there, if the password is weak, a rainbow table or dictionary recovers it in cleartext and grants panel access, from which code execution is usually achievable (e.g., a scheduled task that writes a .jsp).

Why it happens. It's the classic path-traversal pattern: user-controlled input ending up in a file path without validating it stays inside the allowed directory. The null byte adds the problem of a layer that interprets \0 as end-of-string.

How to detect it. The access log shows unauthenticated requests to CFIDE/administrator/enter.cfm (and other panel pages) with the locale=../ parameter repeated, known absolute paths (password.properties, ColdFusion8/lib/) and the %00 (null byte) suffix, a combination no legitimate panel use produces. One source trying different ../ depths or reading password.properties is the signature, and any WAF flags the encoded traversal. Reading the admin hash file followed by a panel login closes the chain.

Defence. Apply Adobe's patches (the 2010 hotfix), restrict network access to CFIDE/administrator, and in general canonicalize and validate any path built from user input. Related to file inclusion and path traversal and to hardening exposed admin panels.