Lucee Server Arbitrary File Creation

Description

Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development.

Lucee Server versions older than 5.3.8.89 allow attackers to access authenticated CFM (ColdFusion) files directly. This allowed atackers to perform a lot of authenticated actions while being completely unauthenticated.

The file imgProcess.cfm is vulnerable to a path traversal vulnerability that allows an attacker to create a file anywhere on the server with attacker-controlled content. This can be easily escalated in RCE (Remote Code Execution) by creating malicious .cfm files.