CVE-2021-21307
HIGH EXPLOITED NUCLEILucee Server <5.3.7.47-5.3.6.68-5.3.5.96 - RCE
Title source: llmExploitation Summary
CVE-2021-21307 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 3 public exploits from researchers including rootxharsh, iamnoooob, wvu, including a Metasploit module exploits/linux/http/lucee_admin_imgprocess_file_write.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a detailed technical writeup on exploiting Lucee misconfigurations in Apple's infrastructure, including path traversal and RCE via CFM files. It discusses WAF bypass techniques and specific vulnerabilities in Lucee's admin panel.
Description
Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. This is fixed in versions 5.3.7.47, 5.3.6.68 or 5.3.5.96. As a workaround, one can block access to the Lucee Administrator.
Exploits (3)
This repository contains a detailed technical writeup on exploiting Lucee misconfigurations in Apple's infrastructure, including path traversal and RCE via CFM files. It discusses WAF bypass techniques and specific vulnerabilities in Lucee's admin panel.
The repository contains functional exploit code for CVE-2021-21307, an unauthenticated remote code execution vulnerability in Lucee Admin. The exploit leverages a file upload mechanism to deploy a malicious payload and achieve RCE.
This Metasploit module exploits an arbitrary file write vulnerability in Lucee Administrator's imgProcess.cfm to achieve remote code execution as the Tomcat user. It writes a CFML stub to execute commands via a POST request.
Nuclei Templates (1)
References (7)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N