CVE-2009-1872

Vulnerability

Multiple cross-site scripting (XSS) vulnerabilities exist in Adobe ColdFusion Server versions 8.0.1, 8, and earlier. The flaws are located in the administrator interface: the startRow parameter in /administrator/logviewer/searchlog.cfm, and the query string in /wizards/common/_logintowizard.cfm, /wizards/common/_authenticatewizarduser.cfm, and /administrator/enter.cfm. These endpoints fail to properly sanitize user-supplied input before reflecting it in the response, allowing injection of arbitrary HTML and script.

Exploitation

An attacker can exploit these vulnerabilities by crafting a malicious URL containing the XSS payload in the vulnerable parameter or query string. The attacker does not require authentication to the ColdFusion server; they only need network access to the server and the ability to trick a victim (e.g., an administrator) into visiting the crafted URL. The injected script executes in the victim's browser within the security context of the ColdFusion Administrator.

Impact

Successful exploitation allows an attacker to execute arbitrary web script or HTML in the victim's browser session. This can lead to session hijacking, defacement, or theft of sensitive information such as administrator credentials if the victim is authenticated to the ColdFusion Administrator. The impact is limited to the browser's security context and does not directly compromise the server.

Mitigation

Not disclosed in the available references. Users should apply the latest ColdFusion security patches from Adobe, as these vulnerabilities are typically addressed in vendor updates. As a workaround, restrict network access to the ColdFusion Administrator interface to trusted users and networks, and ensure proper input validation is implemented.