ColdFusion 8 FCKEditor file upload vulnerability

Description
  • ColdFusion version 8.0.1 installs a vulnerable version of FCKEditor which is enabled by default. FCKEditor includes functionality to handle file uploads and file management, allowing an attacker to upload and execute malicious code.
Remediation
  • One fix is to edit the <strong><span class="bb-dark">config.cfm</span></strong> file at <strong><span class="bb-dark">\CFIDE\scripts\ajax\FCKeditor\editor\filemanager\connectors\cfm</span></strong> to disable uploads (consult <strong>CF8 and FCKEditor Security threat</strong>) .<br/> Also, Adobe released a security patch for this issue and is a very high level patch that should be applied to your servers (consult <strong>Hotfix available for potential ColdFusion 8 input sanitization issue</strong>).
References