gistfile1.txt

CVE- IN Progress
------------------------------------------

Local file read from web root via crafted URI in commandbox  <= 5.1.1   allows remote attackers to fetch sensitive files from WEB-INF/ containing for example database connection strings, smtp credentials. Fetched encrypted connection strings can be easily decrypted due to hardcoded secret KEY for all instances of commandbox. 
 
 ------------------------------------------
 
 [Additional Information]
 Example payload:
     http://192.168.1.22:50100/lucee//WEB-INF/lucee-server/context/lucee-server.xml

 Hardcoded salt for all encrypted connection strings:
    variables.dataSourceSalt = 'sdfsdfs';

  Tool for decryption:
    https://github.com/bdw429s/RailoPasswordManagement
 
 ------------------------------------------
 
 [Vendor of Product]
  https://commandbox.ortusbooks.com/ 
 ------------------------------------------
 
 [Affected Product Code Base]
  commandbox-jre <= 5.1.1
 ------------------------------------------
 
 [Affected Component]
 lucee
 
 ------------------------------------------
 
 [Attack Type]
 Remote
 
 ------------------------------------------
 
 [Attack Vectors]
To exploit vulnerability attacker must have access to the website. Vulnerability can be exploited by remote unauthenticated users. 
 
 ------------------------------------------
 
 [Discoverer]
 Mariusz Popławski (afine.pl)
 
 ------------------------------------------
 
 
 Mariusz Popławski / AFINE.com team