CF8 and FCKEditor Security threat
In a recent SANS posting, they identify a vulnerability in some ColdFusion installations. It involves the richtext feature found in cftexarea. This feature actually uses an open source application called FCKEditor. The FCKEditor has functionality to handle file uploads and file management but this feature should be disabled in the version embedded in CF server. The problem lies in that in some cases the connector that runs this feature is actually turn on.
Is your connector on? Go to..
CFIDE\scripts\ajax\FCKeditor\editor\filemanager\connectors\cfm
Look at config.cfm and see if the connector is on.
If left on, this means a hacker might be able to directly call the filemanager system to upload files and take control of the server. FCKEditor has had some history on being exploited by this type of attack.
Solutions:
1) Turn off the connector so that the filemanagement and file upload features can't work.
2) To be completely safe, delete the entire filemanager directory found under "CFIDE\scripts\ajax\FCKeditor\editor". The embedded version of FCKeditor for CF doesn't and really shouldn't use this feature. So removing those files completely is the safest thing to do. Be mindful that updates to CF might re-introduce those files and naturally re-open the problem.
charlie arehart wrote on 07/02/097:27 PM
John, so to be clear, are you saying that the entry in that file, just inside the cfscript:Config.Enabled = true ;
should be changed to false (if we don't do the second alternative of deleting the directory)?
Also, to be clear, this does seem to be focused on using FCKeditor outside of CF, because the CF default configuration for both 8 and 8.0.1 seem to have it disabled (via other means), according to these 2 blog entries from Adobe engineer Rakshith:
re 8.0: http://www.rakshith.net/blog/?p=41
re 8.0.1: http://www.rakshith.net/blog/?p=58
Again, to be clear, this isn't countering what you've said. Just that at least Adobe seemed to have foreseen an aspect of this problem in the default config. IT does seem they ought perhaps to give us more warning about the implications of enabling it. Maybe that will come soon.
PS John, I realize this seems ironic to ask in a security-related post, but would you consider reducing the complexity of your captcha? I explain how to do it (assuming you're using Lyla captcha) at:
http://www.carehart.org/blog/client/index.cfm/2006/10/7/lyla_captcha_simplified_xml_file