BackgroundIn this post I'll be walking though CVE-2023-29301, which is an access control bypass / password brute force vulnerability in Adobe ColdFusion that I reported to Adobe and was fixed on July 11, 2023 in Adobe Product Security Bulletin APSB23-40.
TL; DR: If you use AES-CBC (or another block cipher operating in CBC mode) to decrypt user-controlled ciphertext, validate the ciphertext with an HMAC or similar integrity check prior to decryption to avoid Padding Oracle vulnerabilities.
TL; DR: If you use AES-CBC (or another block cipher operating in CBC mode) to decrypt user-controlled ciphertext, validate the ciphertext with an HMAC or similar integrity check prior to decryption to avoid Padding Oracle vulnerabilities.
TL; DR: If you use AES-CBC (or another block cipher operating in CBC mode) to decrypt user-controlled ciphertext, validate the ciphertext with an HMAC or similar integrity check prior to decryption to avoid Padding Oracle vulnerabilities.
This is the first of what may be a couple of posts about my presentation from ColdFusion Summit East 2023, which was held in April in Washington, DC.
This is the first of what may be a couple of posts about my presentation from ColdFusion Summit East 2023, which was held in April in Washington, DC.
This is the first of what may be a couple of posts about my presentation from ColdFusion Summit East 2023, which was held in April in Washington, DC.
I spoke at ColdFusion Summit East 2023 last week.
I spoke at ColdFusion Summit East 2023 last week.
I spoke at ColdFusion Summit East 2023 last week.
BackgroundMura CMS is a popular content management system written in ColdFusion/CFML.
BackgroundMura CMS is a popular content management system written in ColdFusion/CFML.
BackgroundMura CMS is a popular content management system written in ColdFusion/CFML.
Update March 6, 2023 - the full security advisory has been posted here: https://hoyahaxa.
Update March 6, 2023 - the full security advisory has been posted here: https://hoyahaxa.
Update March 6, 2023 - the full security advisory has been posted here: https://hoyahaxa.
