More Scope Injection for Fun and Profit (or, why those security updates broke your functions)

Introduction 

Like "Big Two-Hearted River," my last post also has a Part II.  I had previously spent countless hours trying to create a UDFMethod object from user-controlled data via the Service Layer endpoints and eventually gave up decided it was just not possible.  But I had learned more about how lots of ColdFusion internals work -- including variable casting, object types, and functions.  And I kept at it.  While I wasn't able to achieve remote code execution, I ultimately did find a few new scope injection vulnerabilities later on.  These vulnerabilities highlight a broader and often overlooked risk: assumptions about scope isolation and variable safety can quietly break down at the framework level. When that happens, even well-intentioned application logic can become vulnerable in unexpected ways.

The corresponding patches for these vulnerabilities introduced breaking changes with the security fixes -- specifically, the requirement to explicitly declare all arguments for remote functions from APSB25-52 and the changes around scope precedence and variable name reserved words from APSB25-105. Read on as we explore the technical details of how they work and what the underlying risks are.

Districton 1 Slides - Control the Variables and You Control the Code: Language-Level Vulnerabilities in Adobe ColdFusion

It was an honor to speak at DistrictCon Year 1 (which is its second year.  Unlike ColdFusion, DistrictCon counts from 0. 😀)

I got some great questions and feedback after my talk, attended a bunch interesting sessions, and really enjoyed the weekend.  And yes, there was snow.  Lots and lots of snow.  But the conference team, hotel staff, and attendees all handled the weather incredibly well.  I'm already looking forward to next year, and thinking about potential Junkyard targets...

The slides from my talk -- Control the Variables and You Control the Code: Language-Level Vulnerabilities in Adobe ColdFusion -- are now available online below.  Be sure to check out my longer blog post talking about several of the vulnerabilities covered in my presentation too!

Critical Variable Mass Assignment Vulnerability in Adobe ColdFusion (CVE-2023-44350)

Background

Adobe ColdFusion is vulnerable to a Mass Assignment vulnerability that can result in an attacker being able to modify the value of any variable in any scope within the context of remote CFC methods.  A mass assignment vulnerability occurs when application code allows a user to set or modify arbitrary objects or values without verifying that the user is authorized to do so.  Modifying values related to authorization checks, security controls, or other important functions may permit a malicious user to access sensitive data or perform other unexpected actions.  Mass assignment vulnerabilities are not unique to ColdFusion and have affected other languages including ASP.NET, PHP, and Ruby on Rails.