The attack on House of Fusion and Forta.com were not using fckeditor. The issue was with file uploads and a mass attempt to run the uploaded file as it got to the server but before it was validated. I'll have a fix for the issue posted in the morning. I'll also have a writeup on what to look for to see if you've been successfully infiltrated. As for the attackers file, was it a chanm & seraph file and what version? The one I've taken apart for analysis is 1.68. Some nice stuff, some nasty stuff, and some amateur stuff.
On 9/19/09, Yoon Chung <[email protected]> wrote: > > I host sites for several customers and had been battling this issue. I > think I just recently dealt with this issue, this is what I found: > > The attacker used a version of FCKeditor embedded in a shopping cart > software (cfwebstore) to upload a index.cfm file into the store/customtags > directory. This cfm page, from the basic analysis I did, crawls your > webroot and finds all .htm, .html, .cfm, .cfml, .js pages and injects the > script redirect line, and cleans the logs to erase its tracks. This script > was being called every 2 hours from a source in China. Ironically, I > discovered this when I shut down CF for a few hours and noticed a POST > request to this page: > > 2009-09-18 23:38:22 W3SVC14314234 111.111.111.111 POST > /store/customtags/index.cfm - 80 - 222.245.222.205 - 405 0 1 > > Note the source IP is in China. > > The FCKeditor file upload vulnerability has been known for a couple of years > now, and Adobe has a hotfix for CF8, but it obviously does not cover > third-party apps that packages its own copy! And it's well known that it's > possible to use it to upload any file by altering its header to fool > FCKeditor's filemanager to think it's a GIF image. This can be used to > inject just about anything into your site (in this case, a CFM file) and use > CF to run it over the web. > > I recommend all of you who are impacted shut down CF for a few hours and do > the same and find any POST entries to cfm pages and investigate them all. > Search for any copies of fckeditor on your server. I have removed the one I > found (I'll deal with what that breaks later). > > I have the attacker's file saved so that I can investigate further to see > what else it could have done. Will post any new updates. > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~| Want to reach the ColdFusion community with something they want? Let them know on the House of Fusion mailing lists Archive: http://www.houseoffusion.com/groups/cf-talk/message.cfm/messageid:326450 Subscription: http://www.houseoffusion.com/groups/cf-talk/subscribe.cfm Unsubscribe: http://www.houseoffusion.com/cf_lists/unsubscribe.cfm?user=89.70.4
