Hacker News Reader

Comment by Tomdarkness | Hacker News Reader

Found it interesting that Linode uses Coldfusion. Wonder if Adobe has anything to say about the apparent 0-day.

If the hacker's claims are true (Would appear so, the directory listing checks out) then Linode really need to address this ASAP. Passwords are one thing but to have CC details leaked is even worse. I'm not familiar with CC processing but it seems like bad practice to store the encryption keys on the web server.

View on HN

It wouldn't take a zero-day flaw in the Coldfusion stack for a CF application to have an undocumented vulnerability; in fact, it's much more likely that the vulnerability is in the application code than in the stack itself.

The hacker claims it to be a CF 0-day vulnerability:

> 05:05 < ryan_> manager.linode.com was breached with a coldfusion exploit

...

> 05:33 < Ruchira> ryan||: give us the link to cold fusion vulnerability that you are talking about

> 05:34 < ryan||> Ruchira: 0day

> 05:34 < ryan||> linode staff apparently failed to deduce it themselves and relied on chmodding CFIDE to 000

Depending on who you're talking to, an app-level vulnerability in a Linode management console might be called a "0-day". But it's true that a CF stack flaw is not impossible.

"... CF stack flaw is very possible and almost always likely ..."

There, I fixed it for you. Working with ColdFusion is like this: http://25.media.tumblr.com/38d67be62da60b4d3aa1d0ac22e4e314/...

The problem I have balancing the likelihood of CF stack bugs vs. CF app bugs is that I've had to assess a bunch of CF apps, and they're uniformly coded to mid-1990s best practices. No matter how many bugs have been announced in the CF stack, as a betting man my money would always be on CF app bugs.

A patch has recently been issued (09 APR 2013) by Adobe for the various versions of ColdFusion:

"This hotfix resolves a vulnerability that could be exploited to impersonate an authenticated user (CVE-2013-1387).

"This hotfix resolves a vulnerability that could be exploited by an unauthorized user to gain access to the ColdFusion administrator console (CVE-2013-1388)."

http://www.adobe.com/support/security/bulletins/apsb13-10.ht...

Yep that's bad.

This is not a brand new 0-day. This is a bug that Adobe communicated and patched months ago, a bug that affected a lot of folks who didn't follow the standard practice of locking down an administrative directory on the website.

http://www.carehart.org/blog/client/index.cfm/2013/1/2/serio...

The basic overview is this: CF servers have an administrative portal at /cfide/. A bug in the scheduler code (think cron) allowed remote attackers to upload arbitrary code to the server and then execute it. Savvy attackers could upload their own backdoors directly into the administrative folder on the site and then execute that code to gain additional access.

As a Linode customer (admittedly only for a small VM I play around with) I have to say I've been impressed with their service and their prices of course, and I'm waiting for further confirmation about the depth of this hack. I was unaware Linode was using ColdFusion. It should be pointed out that CF is a very mature language, akin to ASP.NET. It is actively maintained by Adobe and used by a huge number of websites globally.

Source: I'm a long time ColdFusion developer.

I wonder if Linode has a requirement to have their CF admin site accessible outside their network (assuming, of course, that the attacker didn't first gain entry into the corporate network, and then attacked the CF installation)?

As someone who still maintains a very old CF application, I am sure to lock down access to the admin site via IP restrictions.

Was it a 0-day? The purported linode chatlog makes it sound like poorly configured CF:

http://turtle.dereferenced.org/~nenolod/linode/linode-abridg...

--------- 05:43 < ryan||> Well linode also had terribly configured coldfusion

05:57 < ryann> <cfif ListLen(cgi.script_name, "/") gt 2 AND ListGetAt(cgi.script_name, 2, "/") eq "linode" AND NOT ListFind("index.cfm,linode_edit.cfm,linode_resize.cfm,label.cfm,cancel.cfm,dc_choose.cfm,su.cfm,pastdue.cfm", ListGetAt(cgi.script_name, 3, "/"))> <cfinclude template="/members/linode/common/dsp_topNav.cfm"> </cfif>

05:57 < ryann> this code

05:57 < ryann> It's so dirty I feel bad reading it

I've never used CF so someone correct me if I'm wrong but I just read that code as rendering the navigation bar in the members area?

Also if you check out my reply below I've C&P'ed the chat logs where he claims it is a zero day:

https://news.ycombinator.com/item?id=5552992

Plus another commenter has linked to a security advisory for exploits in CF that was issued a few days ago.

Reply on news.ycombinator.com