Secunia

Eric Lackey has reported a vulnerability in ColdFusion MX, which can be exploited by malicious, authenticated users to bypass certain security restrictions.

The vulnerability is caused due to the "CFOBJECT" tag and the "CreateObject" function being accessible to all developers by default. This can be exploited to call restricted methods through an object of a specially crafted class written to the ColdFusion library directory.

Successful exploitation may e.g. disclose the administrative password, but requires permissions to create a Cold Fusion template on a server with the "CreateObject" function or the "CFOBJECT" tag enabled.

The vulnerability affects version 6.0 and 6.1.

Solution
The vendor recommends that the Sandbox Security functionality is used to secure this tag and function in shared, untrusted developer environments.

Provided and/or discovered by
Eric Lackey

Changelog
Further details available in Customer Area

Original Advisory
Macromedia:
http://www.macromedia.com/devnet/security/security_zone/mpsb04-10.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area