I host sites for several customers and had been battling this issue. I think I just recently dealt with this issue, this is what I found:
The attacker used a version of FCKeditor embedded in a shopping cart software (cfwebstore) to upload a index.cfm file into the store/customtags directory. This cfm page, from the basic analysis I did, crawls your webroot and finds all .htm, .html, .cfm, .cfml, .js pages and injects the script redirect line, and cleans the logs to erase its tracks. This script was being called every 2 hours from a source in China. Ironically, I discovered this when I shut down CF for a few hours and noticed a POST request to this page: 2009-09-18 23:38:22 W3SVC14314234 111.111.111.111 POST /store/customtags/index.cfm - 80 - 222.245.222.205 - 405 0 1 Note the source IP is in China. The FCKeditor file upload vulnerability has been known for a couple of years now, and Adobe has a hotfix for CF8, but it obviously does not cover third-party apps that packages its own copy! And it's well known that it's possible to use it to upload any file by altering its header to fool FCKeditor's filemanager to think it's a GIF image. This can be used to inject just about anything into your site (in this case, a CFM file) and use CF to run it over the web. I recommend all of you who are impacted shut down CF for a few hours and do the same and find any POST entries to cfm pages and investigate them all. Search for any copies of fckeditor on your server. I have removed the one I found (I'll deal with what that breaks later). I have the attacker's file saved so that I can investigate further to see what else it could have done. Will post any new updates. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Want to reach the ColdFusion community with something they want? Let them know on the House of Fusion mailing lists Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:326444 Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4
