3 ms·

Found it interesting that Linode uses Coldfusion. Wonder if Adobe has anything to say about the apparent 0-day. If the hacker's claims are true (Would appear s

Found it interesting that Linode uses Coldfusion. Wonder if Adobe has anything to say about the apparent 0-day. If the hacker's claims are true (Would appear so, the directory listing checks out) then Linode really need to address this ASAP. Passwords are one thing but to have CC details leaked is even worse. I'm not familiar with CC processing but it seems like bad practice to store the encryption keys on the web server.

tptacek 13y ago
It wouldn't take a zero-day flaw in the Coldfusion stack for a CF application to have an undocumented vulnerability; in fact, it's much more likely that the vulnerability is in the application code than in the stack itself.
- Tomdarkness 13y ago
  The hacker claims it to be a CF 0-day vulnerability: > 05:05 < ryan_> manager.linode.com was breached with a coldfusion exploit ... > 05:33 < Ruchira> ryan||: give us the link to cold fusion vulnerability that you are talking about > 05:34 < ryan||> Ruchira: 0day > 05:34 < ryan||> linode staff apparently failed to deduce it themselves and relied on chmodding CFIDE to 000
  - tptacek 13y ago
    Depending on who you're talking to, an app-level vulnerability in a Linode management console might be called a "0-day". But it's true that a CF stack flaw is not impossible.
    - 127001brewer 13y ago
      "... CF stack flaw is very possible and almost always likely ..." There, I fixed it for you. Working with ColdFusion is like this: http://25.media.tumblr.com/38d67be62da60b4d3aa1d0ac22e4e314/tumblr_mj9bp0LoLC1r3k73wo1_400.gif http://25.media.tumblr.com/38d67be62da60b4d3aa1d0ac22e4e314/...
      - tptacek 13y ago
        The problem I have balancing the likelihood of CF stack bugs vs. CF app bugs is that I've had to assess a bunch of CF apps, and they're uniformly coded to mid-1990s best practices. No matter how many bugs have been announced in the CF stack, as a betting man my money would always be on CF app bugs.
- 127001brewer 13y ago
  A patch has recently been issued (09 APR 2013) by Adobe for the various versions of ColdFusion: "This hotfix resolves a vulnerability that could be exploited to impersonate an authenticated user (CVE-2013-1387). "This hotfix resolves a vulnerability that could be exploited by an unauthorized user to gain access to the ColdFusion administrator console (CVE-2013-1388)." http://www.adobe.com/support/security/bulletins/apsb13-10.html http://www.adobe.com/support/security/bulletins/apsb13-10.ht...
  - tptacek 13y ago
    Yep that's bad.
danso 13y ago
Was it a 0-day? The purported linode chatlog makes it sound like poorly configured CF: http://turtle.dereferenced.org/~nenolod/linode/linode-abridged.txt http://turtle.dereferenced.org/~nenolod/linode/linode-abridg... --------- 05:43 < ryan||> Well linode also had terribly configured coldfusion 05:57 < ryann> <cfif ListLen(cgi.script_name, "/") gt 2 AND ListGetAt(cgi.script_name, 2, "/") eq "linode" AND NOT ListFind("index.cfm,linode_edit.cfm,linode_resize.cfm,label.cfm,cancel.cfm,dc_choose.cfm,su.cfm,pastdue.cfm", ListGetAt(cgi.script_name, 3, "/"))> <cfinclude template="/members/linode/common/dsp_topNav.cfm"> </cfif> 05:57 < ryann> this code 05:57 < ryann> It's so dirty I feel bad reading it
- Tomdarkness 13y ago
  I've never used CF so someone correct me if I'm wrong but I just read that code as rendering the navigation bar in the members area? Also if you check out my reply below I've C&P'ed the chat logs where he claims it is a zero day: https://news.ycombinator.com/item?id=5552992 https://news.ycombinator.com/item?id=5552992 Plus another commenter has linked to a security advisory for exploits in CF that was issued a few days ago.
bmj 13y ago
I wonder if Linode has a requirement to have their CF admin site accessible outside their network (assuming, of course, that the attacker didn't first gain entry into the corporate network, and then attacked the CF installation)? As someone who still maintains a very old CF application, I am sure to lock down access to the admin site via IP restrictions.
jhardcastle 13y ago
This is not a brand new 0-day. This is a bug that Adobe communicated and patched months ago, a bug that affected a lot of folks who didn't follow the standard practice of locking down an administrative directory on the website. http://www.carehart.org/blog/client/index.cfm/2013/1/2/serious_security_threat http://www.carehart.org/blog/client/index.cfm/2013/1/2/serio... The basic overview is this: CF servers have an administrative portal at /cfide/. A bug in the scheduler code (think cron) allowed remote attackers to upload arbitrary code to the server and then execute it. Savvy attackers could upload their own backdoors directly into the administrative folder on the site and then execute that code to gain additional access. As a Linode customer (admittedly only for a small VM I play around with) I have to say I've been impressed with their service and their prices of course, and I'm waiting for further confirmation about the depth of this hack. I was unaware Linode was using ColdFusion. It should be pointed out that CF is a very mature language, akin to ASP.NET. It is actively maintained by Adobe and used by a huge number of websites globally. Source: I'm a long time ColdFusion developer.

tptacek 13y ago

It wouldn't take a zero-day flaw in the Coldfusion stack for a CF application to have an undocumented vulnerability; in fact, it's much more likely that the vulnerability is in the application code than in the stack itself.

Tomdarkness 13y ago
The hacker claims it to be a CF 0-day vulnerability: > 05:05 < ryan_> manager.linode.com was breached with a coldfusion exploit ... > 05:33 < Ruchira> ryan||: give us the link to cold fusion vulnerability that you are talking about > 05:34 < ryan||> Ruchira: 0day > 05:34 < ryan||> linode staff apparently failed to deduce it themselves and relied on chmodding CFIDE to 000
- tptacek 13y ago
  Depending on who you're talking to, an app-level vulnerability in a Linode management console might be called a "0-day". But it's true that a CF stack flaw is not impossible.
  - 127001brewer 13y ago
    "... CF stack flaw is very possible and almost always likely ..." There, I fixed it for you. Working with ColdFusion is like this: http://25.media.tumblr.com/38d67be62da60b4d3aa1d0ac22e4e314/tumblr_mj9bp0LoLC1r3k73wo1_400.gif http://25.media.tumblr.com/38d67be62da60b4d3aa1d0ac22e4e314/...
    - tptacek 13y ago
      The problem I have balancing the likelihood of CF stack bugs vs. CF app bugs is that I've had to assess a bunch of CF apps, and they're uniformly coded to mid-1990s best practices. No matter how many bugs have been announced in the CF stack, as a betting man my money would always be on CF app bugs.
127001brewer 13y ago
A patch has recently been issued (09 APR 2013) by Adobe for the various versions of ColdFusion: "This hotfix resolves a vulnerability that could be exploited to impersonate an authenticated user (CVE-2013-1387). "This hotfix resolves a vulnerability that could be exploited by an unauthorized user to gain access to the ColdFusion administrator console (CVE-2013-1388)." http://www.adobe.com/support/security/bulletins/apsb13-10.html http://www.adobe.com/support/security/bulletins/apsb13-10.ht...
- tptacek 13y ago
  Yep that's bad.

danso 13y ago

Was it a 0-day? The purported linode chatlog makes it sound like poorly configured CF: http://turtle.dereferenced.org/~nenolod/linode/linode-abridged.txt http://turtle.dereferenced.org/~nenolod/linode/linode-abridg... --------- 05:43 < ryan||> Well linode also had terribly configured coldfusion 05:57 < ryann> <cfif ListLen(cgi.script_name, "/") gt 2 AND ListGetAt(cgi.script_name, 2, "/") eq "linode" AND NOT ListFind("index.cfm,linode_edit.cfm,linode_resize.cfm,label.cfm,cancel.cfm,dc_choose.cfm,su.cfm,pastdue.cfm", ListGetAt(cgi.script_name, 3, "/"))> <cfinclude template="/members/linode/common/dsp_topNav.cfm"> </cfif> 05:57 < ryann> this code 05:57 < ryann> It's so dirty I feel bad reading it

Tomdarkness 13y ago
I've never used CF so someone correct me if I'm wrong but I just read that code as rendering the navigation bar in the members area? Also if you check out my reply below I've C&P'ed the chat logs where he claims it is a zero day: https://news.ycombinator.com/item?id=5552992 https://news.ycombinator.com/item?id=5552992 Plus another commenter has linked to a security advisory for exploits in CF that was issued a few days ago.

bmj 13y ago

I wonder if Linode has a requirement to have their CF admin site accessible outside their network (assuming, of course, that the attacker didn't first gain entry into the corporate network, and then attacked the CF installation)? As someone who still maintains a very old CF application, I am sure to lock down access to the admin site via IP restrictions.

jhardcastle 13y ago

This is not a brand new 0-day. This is a bug that Adobe communicated and patched months ago, a bug that affected a lot of folks who didn't follow the standard practice of locking down an administrative directory on the website. http://www.carehart.org/blog/client/index.cfm/2013/1/2/serious_security_threat http://www.carehart.org/blog/client/index.cfm/2013/1/2/serio... The basic overview is this: CF servers have an administrative portal at /cfide/. A bug in the scheduler code (think cron) allowed remote attackers to upload arbitrary code to the server and then execute it. Savvy attackers could upload their own backdoors directly into the administrative folder on the site and then execute that code to gain additional access. As a Linode customer (admittedly only for a small VM I play around with) I have to say I've been impressed with their service and their prices of course, and I'm waiting for further confirmation about the depth of this hack. I was unaware Linode was using ColdFusion. It should be pointed out that CF is a very mature language, akin to ASP.NET. It is actively maintained by Adobe and used by a huge number of websites globally. Source: I'm a long time ColdFusion developer.