CVE-2021-21307 (published 2021-02-11T19:15Z)

Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/lucee/Lucee
commit_details: repo_url: https://github.com/lucee/Lucee
author: Michael Offner
author_date: 2020-10-26 15:57:27+01:00
msg: fixes LDEV-3119
repository: repo_url: https://github.com/lucee/Lucee
repo_name: lucee/Lucee
description: Lucee is a CFML Server, compatible with Adobe ColdFusion © using less resources and delivering better performance.  Lucee simplifies technologies like datasources (MSSQL, Oracle, MySQL and others), HTTP, ORM, caching (redis, ehcache, and memcached) etc.
repo_language: Java
owner: lucee
file_changes: filename: Application.cfc
change_type: ModificationType.MODIFY
diff: @@ -32,6 +32,17 @@ this.sessionCookie.httpOnly = true; // prevent access to session cookies from ja
 this.sessionCookie.sameSite = "strict";
 this.tag.cookie.sameSite = "strict";
 
+public function onRequestStart() {
+	// if not logged in, we only allow access to admin|web|server[.cfm]
+	if(!structKeyExists(session, "passwordWeb") && !structKeyExists(session, "passwordServer")){
+		var fileName=listLast(cgi.script_name,"/");
+		if(fileName!="admin.cfm" && fileName!="web.cfm" && fileName!="server.cfm") {
+			cfheader(statuscode="404" statustext="Invalid access");
+        	abort;
+		}
+	}
+}
+
 public function onApplicationStart(){
 	if(structKeyExists(server.system.environment,"LUCEE_ADMIN_ENABLED") && server.system.environment.LUCEE_ADMIN_ENABLED EQ false){
 		cfheader(statuscode="404" statustext="Invalid access");

programming_language: HTML
filename: build.xml
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <project default="core" basedir="." name="Lucee" xmlns:artifact="antlib:org.apache.maven.artifact.ant">
 
-  <property name="version" value="5.3.8.88-SNAPSHOT"/>
+  <property name="version" value="5.3.8.89-SNAPSHOT"/>
 
   <path id="maven-ant-tasks.classpath" path="../ant/lib/maven-ant-tasks-2.1.3.jar" />
   <typedef resource="org/apache/maven/artifact/ant/antlib.xml"

programming_language: Shell
filename: pom.xml
change_type: ModificationType.MODIFY
diff: @@ -3,7 +3,7 @@
 
   <groupId>org.lucee</groupId>
   <artifactId>lucee</artifactId>
-  <version>5.3.8.88-SNAPSHOT</version>
+  <version>5.3.8.89-SNAPSHOT</version>
   <packaging>jar</packaging>
 
   <name>Lucee Loader Build</name>

programming_language: HTML