Many blogs are reporting this, and frankly I don't have more to add to the already good reports out there, but be sure you read and respond to this new issue involving FCKEditor. Details:
CF8 and FCKEditor Security Threat
ColdFusion 8 FCKeditor Vulnerability
Please help spread the word.
Archived Comments
Any idea if a standard install of FCKeditor is venerable?
I have it installed on the root of some web sites /FCKeditor/ and what i am reading i should probably put this code in a password protected folder to help avoid people directly accessing the file upload code in it.
No idea at all - sorry. I don't use FCKEditor myself.
Thanks for the heads up! I had an ASP.Net site compromised via FCKEditor a few months ago, but it never occurred to me that CF sites that don't even use the rich text editor could be vulnerable.
To answer Chad's question, older versions of FCKEditor have definitely been vulnerable. Not sure if it's better now.
Also please refer to this important post http://blogs.adobe.com/psir... from Adobe Product Security Incident Team. A fix from Adobe will be out shortly.
One thing I'm not seeing mentioned much, if at all, on the blogs about this is that the hackers seem to be expoliting JSP support in ColdFusion Enterprise to do all their damage. They can completely get around sandboxing, attack every site on the box, do all kind of damage to the server. Why is this enabled by default, and why are there not clearer warnings from Adobe about it?? If a hacker manages to get a file onto a site, whatever means that might be, it seems they should not be able to cause so much mischief so easily. It seems this is every bit as much of the issue as the vulnerable install of the editor. Or am I missing something??
For those that use FCKeditor outside of CF, a new patch can be downloaded as of today: http://www.fckeditor.net/
I assume it's in response to all these postings lately, but there has been no explanation for that patch yet.
It is supposedly possible to upgrade the CF version of FCKeditor, but I've never tried it myself. I use FCKeditor as a custom tag instead.
While you're fixing settings, remember that it's not just CFM pages that can be uploaded... JSP can execute as well, and if you're on a windows server, possibly ASP... see the post on coldfusion muse for some files
http://www.coldfusionmuse.c...