CVE-2021-21307: Missing Authorization (CWE-862)
value: Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 9.8
Published: 2021-02-11T19:15Z
Repository: https://github.com/lucee/Lucee
Language: XML
Files changed: core/src/main/cfml/context/admin/Application.cfc, loader/build.xml, loader/pom.xml
Commit date: 2020-10-26 15:57:27 +0100
Commit message: fixes LDEV-3119

Diff: diff --git a/core/src/main/cfml/context/admin/Application.cfc b/core/src/main/cfml/context/admin/Application.cfc
index 114c251bc..3eb4cd701 100644
--- a/core/src/main/cfml/context/admin/Application.cfc
+++ b/core/src/main/cfml/context/admin/Application.cfc
@@ -30,10 +30,21 @@ this.localmode="update";
 this.web.charset="utf-8";
 this.sessionCookie.httpOnly = true; // prevent access to session cookies from javascript
 this.sessionCookie.sameSite = "strict";
 this.tag.cookie.sameSite = "strict";
 
+public function onRequestStart() {
+	// if not logged in, we only allow access to admin|web|server[.cfm]
+	if(!structKeyExists(session, "passwordWeb") && !structKeyExists(session, "passwordServer")){
+		var fileName=listLast(cgi.script_name,"/");
+		if(fileName!="admin.cfm" && fileName!="web.cfm" && fileName!="server.cfm") {
+			cfheader(statuscode="404" statustext="Invalid access");
+        	abort;
+		}
+	}
+}
+
 public function onApplicationStart(){
 	if(structKeyExists(server.system.environment,"LUCEE_ADMIN_ENABLED") && server.system.environment.LUCEE_ADMIN_ENABLED EQ false){
 		cfheader(statuscode="404" statustext="Invalid access");
         abort;
 	}
diff --git a/loader/build.xml b/loader/build.xml
index b7b451c6c..4cadbb687 100644
--- a/loader/build.xml
+++ b/loader/build.xml
@@ -1,9 +1,9 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project default="core" basedir="." name="Lucee" xmlns:artifact="antlib:org.apache.maven.artifact.ant">
 
-  <property name="version" value="5.3.8.88-SNAPSHOT"/>
+  <property name="version" value="5.3.8.89-SNAPSHOT"/>
 
   <path id="maven-ant-tasks.classpath" path="../ant/lib/maven-ant-tasks-2.1.3.jar" />
   <typedef resource="org/apache/maven/artifact/ant/antlib.xml"
            uri="antlib:org.apache.maven.artifact.ant"
            classpathref="maven-ant-tasks.classpath" />
diff --git a/loader/pom.xml b/loader/pom.xml
index e3aa0fc0c..855653c0f 100644
--- a/loader/pom.xml
+++ b/loader/pom.xml
@@ -1,11 +1,11 @@
 <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
   <modelVersion>4.0.0</modelVersion>
 
   <groupId>org.lucee</groupId>
   <artifactId>lucee</artifactId>
-  <version>5.3.8.88-SNAPSHOT</version>
+  <version>5.3.8.89-SNAPSHOT</version>
   <packaging>jar</packaging>
 
   <name>Lucee Loader Build</name>
   <description>Building the Lucee Loader JAR</description>
   <url>http://maven.lucee.org/loader/</url>

Vulnerable code:   <property name="version" value="5.3.8.88-SNAPSHOT"/>
  <version>5.3.8.88-SNAPSHOT</version>
Fixed code: public function onRequestStart() {
	// if not logged in, we only allow access to admin|web|server[.cfm]
	if(!structKeyExists(session, "passwordWeb") && !structKeyExists(session, "passwordServer")){
		var fileName=listLast(cgi.script_name,"/");
		if(fileName!="admin.cfm" && fileName!="web.cfm" && fileName!="server.cfm") {
			cfheader(statuscode="404" statustext="Invalid access");
        	abort;
		}
	}
}

  <property name="version" value="5.3.8.89-SNAPSHOT"/>
  <version>5.3.8.89-SNAPSHOT</version>