HackMyCF.com Now Detects BlazeDS Vulnerability
I've just finished updating the HackMyCF.com ColdFusion security scanner to detect the BlaseDS Vulnerability APSB10-05 announced in February 2010. As you hopefully know, this vulnerability also effects ColdFusion 7-9, because it has BlaseDS installed by default. So make sure and patch your servers, this vulnerability allows an attacker to read any file on your server that ColdFusion has permission to read, which can make it very easy for an attacker to break in in many cases.
Head over to HackmyCF.com and see if we are detecting the vulnerability on your server (note that even if we are not detecting it, you should still make sure you have applied this important patch).
Big thanks to Joshua Cyr for providing me with some helpful information about this vulnerability.
- Fixinator and Foundeo Security Bundle - May 14, 2019
- New HackMyCF Features - October 24, 2013
- HackMyCF Updated for APSB11-29 Security Hotfix - December 15, 2011
- Determining Which Cumulative Hotfixes are Installed on ColdFusion - September 20, 2011
- CFSummit 2016 Slides - October 17, 2016
- Travis CI Error when installing oraclejdk8
- Tuning Tomcat IIS Connectors worker.properties and server.xml
- Push Tomcat logs with the AWS CloudWatch Logs Agent
- Sending nginx access logs to CloudWatch Logs Agent
- Setup CloudWatch Logs Agent on Ubuntu 18.04 LTS
- Tomcat Virtual Directory Howto
- Communications link failure MySQL JDBC with TLS
- Redirect www and non https in IIS using web.config