Drive-by Download Attack Hits Multiple Sites Running Vulnerable ColdFusion Application
Hackers are running a mass compromise against sites running vulnerable ColdFusion application server installations.
Security watchers at the SANS Institute’s Internet Storm Centre are warning that a “high number” of sites have been hit over the last 36 hours or so. Miscreants are exploiting sites running older installations of some ColdFusion applications, such as FCKEditor (a popular HTML text editor) or CKFinder (an Ajax file manager).
The two main strands of the assault both target FCKEditor. Firstly version 8.0.1 of ColdFusion installs a vulnerable version of FCKEditor that is enabled by default. The security flaw creates a means for criminals to upload arbitrary files on affected servers. Details of how to resolve this problem can be found on ColdFusion’s site.
The second strand of the attack relies on third party applications, in particular the CFWebstore e-commerce app, that incorporate vulnerable versions of FCKEditor.
Hackers are taking advantage of the vulnerabilities to plant malicious scripts onto compromised websites, as part of a drive-by download attack that ultimately aims to infect visiting surfers.
SANS reckons the crackers behind the attack are the same as the gang that pulled off a similar attack back in March. Security researchers urge sites to review their ColdFusion installations, paying particular attention to deleting older applications that may have been left around as orphans during systems upgrades.
Credit: The Register
More on CyberInsecure:
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.