1/13/25, 12:55 PM
Coldfusion/Lucee
An Initial Analysis of Adobe ColdFusion CVE-2024-53961
A ColdFusion security patch released two days before Christmas? I have a feeling that may have resulted in many sysadmins shouting "Fiddlesticks!" (or perhaps another f-word) earlier today.
12/24/24, 3:53 AM
Coldfusion/Lucee
BSidesLV 2024 Slides - Modern ColdFusion Exploitation and Attack Surface Reduction
Thank you to BSidesLV for the opportunity to speak this year. The slides from my talk, Modern ColdFusion Exploitation and Attack Surface Reduction, are now online below. They're pretty similar to my Summercon slides, with a few updates.
8/8/24, 3:33 PM
Coldfusion/Lucee
On ColdFusion Administrator Access Control Bypass Techniques
IntroductionAccess Control is frequently boring but important.
7/24/24, 7:15 PM
Coldfusion/Lucee
Summercon 2024 Slides - Modern ColdFusion Exploitation and Attack Surface Reduction
Last Friday it was an absolute honor to talk about ColdFusion security at Summercon.
7/22/24, 9:59 PM
Coldfusion/Lucee
Bypassing Imperva SecureSphere WAF (CVE-2023-50969)
Background Imperva SecureSphere Web Application Firewall (WAF) is an on-premise security solution to inspect, monitor and block traffic to web applications.
3/27/24, 9:00 AM
Coldfusion/Lucee
Defending Against CVE-2024-20767 (ColdFusion Arbitrary File System Read)
Technical details for CVE-2024-20767 (ColdFusion Arbitrary File System Read) from APSB24-14 have now been publicly disclosed by the researcher who reported it to Adobe PSIRT: https://jeva.
3/25/24, 2:45 PM
Coldfusion/Lucee
If You're Running an Intranet Connections Lucee Instance, Ensure That You've Change the Default Lucee Admin Password
Last week, researchers at Sprocket Security wrote about post-exploitation in Lucee via malicious extensions.
3/21/24, 2:50 PM
Coldfusion/Lucee
One Reason Why Your ColdFusion Server May Still Be Vulnerable Even With the Latest Security Updates Installed
Next Tuesday is Adobe Patch Tuesday.
3/5/24, 5:03 AM
Coldfusion/Lucee
What Does ColdFusion's verifyClient() Do?
I recently saw a ColdFusion question about verifyClient and remote CFC functions.
2/27/24, 6:34 AM
Coldfusion/Lucee
Thinking Defensively About Three Recent Lucee Vulnerabilities
Last week, Harsh Jaiswal and Rahul Maini from ProjectDiscovery released some impressive security research on multiple vulnerabilities in Lucee (and Mura CMS and Masa CMS).
2/21/24, 6:23 PM
Coldfusion/Lucee
A Christmas Post: Beer and Bounties
Christmas came early this year in Potrero Hill and it was sad news for craft beer drinkers.
12/23/23, 10:24 PM
Coldfusion/Lucee
Critical Variable Mass Assignment Vulnerability in Adobe ColdFusion (CVE-2023-44350)
BackgroundAdobe ColdFusion is vulnerable to a Mass Assignment vulnerability that can result in an attacker being able to modify the value of any variable in any scope within the context of remote CFC methods.
11/15/23, 5:01 PM
Coldfusion/Lucee
New Blog Domain - www.hoyahaxa.com
I recently moved my blog over to a custom domain -- https://www.
10/19/23, 4:00 PM
Coldfusion/Lucee
ColdFusion, Connectors, and CFAdmin Security (for more than just ColdFusion 2023 Update 5 and ColdFusion 2021 Update 11)
IntroductionThis post is about ColdFusion 2023 Update 5 and ColdFusion 2021 Update 11, but it's also about more than just those versions.
10/18/23, 8:37 PM
Coldfusion/Lucee
Exploiting CVE-2017-11286 Six Years Later: XXE in ColdFusion via WDDX Packet
Introduction🎈🎂🎂🎂🎂🎂🎂🎈Six years ago today, on September 12, 2017, Adobe released APSB17-30.
9/12/23, 7:30 AM
Coldfusion/Lucee
Technical Details for CVE-2023-29301: Adobe ColdFusion Access Control Bypass for a CFAdmin Authentication Component
BackgroundIn this post I'll be walking though CVE-2023-29301, which is an access control bypass / password brute force vulnerability in Adobe ColdFusion that I reported to Adobe and was fixed on July 11, 2023 in Adobe Product Security Bulletin APSB23-40.
8/30/23, 1:09 PM
Coldfusion/Lucee
On ColdFusion, AES, and Padding Oracle Attacks: Hic Sunt Dracones
TL; DR: If you use AES-CBC (or another block cipher operating in CBC mode) to decrypt user-controlled ciphertext, validate the ciphertext with an HMAC or similar integrity check prior to decryption to avoid Padding Oracle vulnerabilities.
7/4/23, 2:20 AM
Coldfusion/Lucee
Why You Don't Want To Use CFMX_COMPAT Encryption
This is the first of what may be a couple of posts about my presentation from ColdFusion Summit East 2023, which was held in April in Washington, DC.
5/13/23, 2:54 AM
Coldfusion/Lucee
Slides from ColdFusion Summit East 2023 - "Codes, Ciphers, and ColdFusion: What They Don't Want You To Know"
I spoke at ColdFusion Summit East 2023 last week.
4/10/23, 3:21 PM
Coldfusion/Lucee
Authentication Bypass Vulnerability in Mura CMS and Masa CMS (CVE-2022-47003 and CVE-2022-47002)
BackgroundMura CMS is a popular content management system written in ColdFusion/CFML.
3/6/23, 9:00 AM
Coldfusion/Lucee
Preliminary Security Advisory - Authentication Bypass Vulnerability in Mura CMS and Masa CMS (CVE-2022-47003 and CVE-2022-47002)
Update March 6, 2023 - the full security advisory has been posted here: https://hoyahaxa.
1/28/23, 8:40 PM
Coldfusion/Lucee
On ColdFusion, XXE, and other XML Attacks
An IntroductionThis is the first of what may become a few blog posts based on my CFSummit 2022 talk.
11/9/22, 3:40 PM
Coldfusion/Lucee
Slides from ColdFusion Summit 2022 - "Below the Surface: Web Vulnerabilities Hiding in your Applications"
Photo credit: @coldfumonkehI attended my first CFSummit, where I talked about a handful of web vulnerability classes (SSRF, Session Puzzles, Cryptography flaws, and XML attacks) that might be overlooked by some ColdFusion/CFML developers.
10/6/22, 8:41 PM
Coldfusion/Lucee
Bygone Vulnerabilities - Remote Code Execution in IBM Lotus SameTime Clients (CVE-2013-0553)
IntroductionIt's time to dive into another old vulnerability.
5/27/22, 11:56 AM
Coldfusion/Lucee